diff --git a/.github/workflows/pull-request-merged.yml b/.github/workflows/pull-request-merged.yml index b4ad343a4e..090950f79b 100644 --- a/.github/workflows/pull-request-merged.yml +++ b/.github/workflows/pull-request-merged.yml @@ -12,6 +12,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + ref: ${{ github.event.pull_request.merge_commit_sha }} - name: Set short git commit SHA id: vars diff --git a/README.md b/README.md index 5e20971be0..82db510e66 100644 --- a/README.md +++ b/README.md @@ -86,11 +86,11 @@ prowler dashboard | Provider | Checks | Services | [Compliance Frameworks](https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/compliance/) | [Categories](https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/misc/#categories) | |---|---|---|---|---| -| AWS | 564 | 82 | 33 | 10 | +| AWS | 564 | 82 | 34 | 10 | | GCP | 79 | 13 | 7 | 3 | | Azure | 140 | 18 | 8 | 3 | | Kubernetes | 83 | 7 | 4 | 7 | -| GitHub | 1 | 1 | 1 | 0 | +| GitHub | 3 | 2 | 1 | 0 | | M365 | 44 | 2 | 2 | 0 | | NHN (Unofficial) | 6 | 2 | 1 | 0 | diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md index f25354e058..96dc979d1e 100644 --- a/api/CHANGELOG.md +++ b/api/CHANGELOG.md @@ -2,12 +2,14 @@ All notable changes to the **Prowler API** are documented in this file. -## [v1.8.0] (Prowler UNRELEASED) +## [v1.8.0] (Prowler v5.7.0) ### Added - Added huge improvements to `/findings/metadata` and resource related filters for findings [(#7690)](https://github.com/prowler-cloud/prowler/pull/7690). - Added improvements to `/overviews` endpoints [(#7690)](https://github.com/prowler-cloud/prowler/pull/7690). - Added new queue to perform backfill background tasks [(#7690)](https://github.com/prowler-cloud/prowler/pull/7690). +- Added new endpoints to retrieve latest findings and metadata [(#7743)](https://github.com/prowler-cloud/prowler/pull/7743). +- Added export support for Prowler ThreatScore in M365 [(7783)](https://github.com/prowler-cloud/prowler/pull/7783) --- diff --git a/api/src/backend/api/filters.py b/api/src/backend/api/filters.py index 6d9512f2e2..9e95016e1d 100644 --- a/api/src/backend/api/filters.py +++ b/api/src/backend/api/filters.py @@ -81,6 +81,114 @@ class ChoiceInFilter(BaseInFilter, ChoiceFilter): pass +class CommonFindingFilters(FilterSet): + # We filter providers from the scan in findings + provider = UUIDFilter(field_name="scan__provider__id", lookup_expr="exact") + provider__in = UUIDInFilter(field_name="scan__provider__id", lookup_expr="in") + provider_type = ChoiceFilter( + choices=Provider.ProviderChoices.choices, field_name="scan__provider__provider" + ) + provider_type__in = ChoiceInFilter( + choices=Provider.ProviderChoices.choices, field_name="scan__provider__provider" + ) + provider_uid = CharFilter(field_name="scan__provider__uid", lookup_expr="exact") + provider_uid__in = CharInFilter(field_name="scan__provider__uid", lookup_expr="in") + provider_uid__icontains = CharFilter( + field_name="scan__provider__uid", lookup_expr="icontains" + ) + provider_alias = CharFilter(field_name="scan__provider__alias", lookup_expr="exact") + provider_alias__in = CharInFilter( + field_name="scan__provider__alias", lookup_expr="in" + ) + provider_alias__icontains = CharFilter( + field_name="scan__provider__alias", lookup_expr="icontains" + ) + + updated_at = DateFilter(field_name="updated_at", lookup_expr="date") + + uid = CharFilter(field_name="uid") + delta = ChoiceFilter(choices=Finding.DeltaChoices.choices) + status = ChoiceFilter(choices=StatusChoices.choices) + severity = ChoiceFilter(choices=SeverityChoices) + impact = ChoiceFilter(choices=SeverityChoices) + muted = BooleanFilter( + help_text="If this filter is not provided, muted and non-muted findings will be returned." + ) + + resources = UUIDInFilter(field_name="resource__id", lookup_expr="in") + + region = CharFilter(method="filter_resource_region") + region__in = CharInFilter(field_name="resource_regions", lookup_expr="overlap") + region__icontains = CharFilter( + field_name="resource_regions", lookup_expr="icontains" + ) + + service = CharFilter(method="filter_resource_service") + service__in = CharInFilter(field_name="resource_services", lookup_expr="overlap") + service__icontains = CharFilter( + field_name="resource_services", lookup_expr="icontains" + ) + + resource_uid = CharFilter(field_name="resources__uid") + resource_uid__in = CharInFilter(field_name="resources__uid", lookup_expr="in") + resource_uid__icontains = CharFilter( + field_name="resources__uid", lookup_expr="icontains" + ) + + resource_name = CharFilter(field_name="resources__name") + resource_name__in = CharInFilter(field_name="resources__name", lookup_expr="in") + resource_name__icontains = CharFilter( + field_name="resources__name", lookup_expr="icontains" + ) + + resource_type = CharFilter(method="filter_resource_type") + resource_type__in = CharInFilter(field_name="resource_types", lookup_expr="overlap") + resource_type__icontains = CharFilter( + field_name="resources__type", lookup_expr="icontains" + ) + + # Temporarily disabled until we implement tag filtering in the UI + # resource_tag_key = CharFilter(field_name="resources__tags__key") + # resource_tag_key__in = CharInFilter( + # field_name="resources__tags__key", lookup_expr="in" + # ) + # resource_tag_key__icontains = CharFilter( + # field_name="resources__tags__key", lookup_expr="icontains" + # ) + # resource_tag_value = CharFilter(field_name="resources__tags__value") + # resource_tag_value__in = CharInFilter( + # field_name="resources__tags__value", lookup_expr="in" + # ) + # resource_tag_value__icontains = CharFilter( + # field_name="resources__tags__value", lookup_expr="icontains" + # ) + # resource_tags = CharInFilter( + # method="filter_resource_tag", + # lookup_expr="in", + # help_text="Filter by resource tags `key:value` pairs.\nMultiple values may be " + # "separated by commas.", + # ) + + def filter_resource_service(self, queryset, name, value): + return queryset.filter(resource_services__contains=[value]) + + def filter_resource_region(self, queryset, name, value): + return queryset.filter(resource_regions__contains=[value]) + + def filter_resource_type(self, queryset, name, value): + return queryset.filter(resource_types__contains=[value]) + + def filter_resource_tag(self, queryset, name, value): + overall_query = Q() + for key_value_pair in value: + tag_key, tag_value = key_value_pair.split(":", 1) + overall_query |= Q( + resources__tags__key__icontains=tag_key, + resources__tags__value__icontains=tag_value, + ) + return queryset.filter(overall_query).distinct() + + class TenantFilter(FilterSet): inserted_at = DateFilter(field_name="inserted_at", lookup_expr="date") updated_at = DateFilter(field_name="updated_at", lookup_expr="date") @@ -257,94 +365,7 @@ class ResourceFilter(ProviderRelationshipFilterSet): return queryset.filter(tags__text_search=value) -class FindingFilter(FilterSet): - # We filter providers from the scan in findings - provider = UUIDFilter(field_name="scan__provider__id", lookup_expr="exact") - provider__in = UUIDInFilter(field_name="scan__provider__id", lookup_expr="in") - provider_type = ChoiceFilter( - choices=Provider.ProviderChoices.choices, field_name="scan__provider__provider" - ) - provider_type__in = ChoiceInFilter( - choices=Provider.ProviderChoices.choices, field_name="scan__provider__provider" - ) - provider_uid = CharFilter(field_name="scan__provider__uid", lookup_expr="exact") - provider_uid__in = CharInFilter(field_name="scan__provider__uid", lookup_expr="in") - provider_uid__icontains = CharFilter( - field_name="scan__provider__uid", lookup_expr="icontains" - ) - provider_alias = CharFilter(field_name="scan__provider__alias", lookup_expr="exact") - provider_alias__in = CharInFilter( - field_name="scan__provider__alias", lookup_expr="in" - ) - provider_alias__icontains = CharFilter( - field_name="scan__provider__alias", lookup_expr="icontains" - ) - - updated_at = DateFilter(field_name="updated_at", lookup_expr="date") - - uid = CharFilter(field_name="uid") - delta = ChoiceFilter(choices=Finding.DeltaChoices.choices) - status = ChoiceFilter(choices=StatusChoices.choices) - severity = ChoiceFilter(choices=SeverityChoices) - impact = ChoiceFilter(choices=SeverityChoices) - muted = BooleanFilter( - help_text="If this filter is not provided, muted and non-muted findings will be returned." - ) - - resources = UUIDInFilter(field_name="resource__id", lookup_expr="in") - - region = CharFilter(method="filter_resource_region") - region__in = CharInFilter(field_name="resource_regions", lookup_expr="overlap") - region__icontains = CharFilter( - field_name="resource_regions", lookup_expr="icontains" - ) - - service = CharFilter(method="filter_resource_service") - service__in = CharInFilter(field_name="resource_services", lookup_expr="overlap") - service__icontains = CharFilter( - field_name="resource_services", lookup_expr="icontains" - ) - - resource_uid = CharFilter(field_name="resources__uid") - resource_uid__in = CharInFilter(field_name="resources__uid", lookup_expr="in") - resource_uid__icontains = CharFilter( - field_name="resources__uid", lookup_expr="icontains" - ) - - resource_name = CharFilter(field_name="resources__name") - resource_name__in = CharInFilter(field_name="resources__name", lookup_expr="in") - resource_name__icontains = CharFilter( - field_name="resources__name", lookup_expr="icontains" - ) - - resource_type = CharFilter(method="filter_resource_type") - resource_type__in = CharInFilter(field_name="resource_types", lookup_expr="overlap") - resource_type__icontains = CharFilter( - field_name="resources__type", lookup_expr="icontains" - ) - - # Temporarily disabled until we implement tag filtering in the UI - # resource_tag_key = CharFilter(field_name="resources__tags__key") - # resource_tag_key__in = CharInFilter( - # field_name="resources__tags__key", lookup_expr="in" - # ) - # resource_tag_key__icontains = CharFilter( - # field_name="resources__tags__key", lookup_expr="icontains" - # ) - # resource_tag_value = CharFilter(field_name="resources__tags__value") - # resource_tag_value__in = CharInFilter( - # field_name="resources__tags__value", lookup_expr="in" - # ) - # resource_tag_value__icontains = CharFilter( - # field_name="resources__tags__value", lookup_expr="icontains" - # ) - # resource_tags = CharInFilter( - # method="filter_resource_tag", - # lookup_expr="in", - # help_text="Filter by resource tags `key:value` pairs.\nMultiple values may be " - # "separated by commas.", - # ) - +class FindingFilter(CommonFindingFilters): scan = UUIDFilter(method="filter_scan_id") scan__in = UUIDInFilter(method="filter_scan_id_in") @@ -512,16 +533,6 @@ class FindingFilter(FilterSet): return queryset.filter(id__lt=end) - def filter_resource_tag(self, queryset, name, value): - overall_query = Q() - for key_value_pair in value: - tag_key, tag_value = key_value_pair.split(":", 1) - overall_query |= Q( - resources__tags__key__icontains=tag_key, - resources__tags__value__icontains=tag_value, - ) - return queryset.filter(overall_query).distinct() - @staticmethod def maybe_date_to_datetime(value): dt = value @@ -530,6 +541,31 @@ class FindingFilter(FilterSet): return dt +class LatestFindingFilter(CommonFindingFilters): + class Meta: + model = Finding + fields = { + "id": ["exact", "in"], + "uid": ["exact", "in"], + "delta": ["exact", "in"], + "status": ["exact", "in"], + "severity": ["exact", "in"], + "impact": ["exact", "in"], + "check_id": ["exact", "in", "icontains"], + } + filter_overrides = { + FindingDeltaEnumField: { + "filter_class": CharFilter, + }, + StatusEnumField: { + "filter_class": CharFilter, + }, + SeverityEnumField: { + "filter_class": CharFilter, + }, + } + + class ProviderSecretFilter(FilterSet): inserted_at = DateFilter(field_name="inserted_at", lookup_expr="date") updated_at = DateFilter(field_name="updated_at", lookup_expr="date") diff --git a/api/src/backend/api/models.py b/api/src/backend/api/models.py index 676b3b116c..3b85d2208f 100644 --- a/api/src/backend/api/models.py +++ b/api/src/backend/api/models.py @@ -218,9 +218,13 @@ class Provider(RowLevelSecurityProtectedModel): @staticmethod def validate_m365_uid(value): - if not re.match(r"^[a-zA-Z0-9-]+\.onmicrosoft\.com$", value): + if not re.match( + r"""^(?!-)[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.(?!-)[A-Za-z0-9]""" + r"""(?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*\.[A-Za-z]{2,}$""", + value, + ): raise ModelValidationError( - detail="M365 tenant ID must be a valid domain.", + detail="M365 domain ID must be a valid domain.", code="m365-uid", pointer="/data/attributes/uid", ) @@ -426,6 +430,7 @@ class Scan(RowLevelSecurityProtectedModel): PeriodicTask, on_delete=models.CASCADE, null=True, blank=True ) output_location = models.CharField(blank=True, null=True, max_length=200) + # TODO: mutelist foreign key class Meta(RowLevelSecurityProtectedModel.Meta): diff --git a/api/src/backend/api/specs/v1.yaml b/api/src/backend/api/specs/v1.yaml index 534a232ca8..4a5bdb4662 100644 --- a/api/src/backend/api/specs/v1.yaml +++ b/api/src/backend/api/specs/v1.yaml @@ -1238,6 +1238,416 @@ paths: schema: $ref: '#/components/schemas/FindingDynamicFilterResponse' description: '' + /api/v1/findings/latest: + get: + operationId: findings_latest_retrieve + description: Retrieve a list of the latest findings from the latest scans for + each provider with options for filtering by various criteria. + summary: List the latest findings + parameters: + - in: query + name: fields[findings] + schema: + type: array + items: + type: string + enum: + - uid + - delta + - status + - status_extended + - severity + - check_id + - check_metadata + - raw_result + - inserted_at + - updated_at + - first_seen_at + - muted + - url + - scan + - resources + description: endpoint return only specific fields in the response on a per-type + basis by including a fields[TYPE] query parameter. + explode: false + - in: query + name: filter[check_id] + schema: + type: string + - in: query + name: filter[check_id__icontains] + schema: + type: string + - in: query + name: filter[check_id__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[delta] + schema: + type: string + nullable: true + enum: + - changed + - new + description: |- + * `new` - New + * `changed` - Changed + - in: query + name: filter[delta__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[id] + schema: + type: string + format: uuid + - in: query + name: filter[id__in] + schema: + type: array + items: + type: string + format: uuid + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[impact] + schema: + type: string + enum: + - critical + - high + - informational + - low + - medium + description: |- + * `critical` - Critical + * `high` - High + * `medium` - Medium + * `low` - Low + * `informational` - Informational + - in: query + name: filter[impact__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[muted] + schema: + type: boolean + description: If this filter is not provided, muted and non-muted findings + will be returned. + - in: query + name: filter[provider] + schema: + type: string + format: uuid + - in: query + name: filter[provider__in] + schema: + type: array + items: + type: string + format: uuid + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[provider_alias] + schema: + type: string + - in: query + name: filter[provider_alias__icontains] + schema: + type: string + - in: query + name: filter[provider_alias__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[provider_type] + schema: + type: string + enum: + - aws + - azure + - gcp + - kubernetes + - m365 + description: |- + * `aws` - AWS + * `azure` - Azure + * `gcp` - GCP + * `kubernetes` - Kubernetes + * `m365` - M365 + - in: query + name: filter[provider_type__in] + schema: + type: array + items: + type: string + enum: + - aws + - azure + - gcp + - kubernetes + - m365 + description: |- + Multiple values may be separated by commas. + + * `aws` - AWS + * `azure` - Azure + * `gcp` - GCP + * `kubernetes` - Kubernetes + * `m365` - M365 + explode: false + style: form + - in: query + name: filter[provider_uid] + schema: + type: string + - in: query + name: filter[provider_uid__icontains] + schema: + type: string + - in: query + name: filter[provider_uid__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[region] + schema: + type: string + - in: query + name: filter[region__icontains] + schema: + type: string + - in: query + name: filter[region__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[resource_name] + schema: + type: string + - in: query + name: filter[resource_name__icontains] + schema: + type: string + - in: query + name: filter[resource_name__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[resource_type] + schema: + type: string + - in: query + name: filter[resource_type__icontains] + schema: + type: string + - in: query + name: filter[resource_type__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[resource_uid] + schema: + type: string + - in: query + name: filter[resource_uid__icontains] + schema: + type: string + - in: query + name: filter[resource_uid__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[resources] + schema: + type: array + items: + type: string + format: uuid + description: Multiple values may be separated by commas. + explode: false + style: form + - name: filter[search] + required: false + in: query + description: A search term. + schema: + type: string + - in: query + name: filter[service] + schema: + type: string + - in: query + name: filter[service__icontains] + schema: + type: string + - in: query + name: filter[service__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[severity] + schema: + type: string + enum: + - critical + - high + - informational + - low + - medium + description: |- + * `critical` - Critical + * `high` - High + * `medium` - Medium + * `low` - Low + * `informational` - Informational + - in: query + name: filter[severity__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[status] + schema: + type: string + enum: + - FAIL + - MANUAL + - PASS + description: |- + * `FAIL` - Fail + * `PASS` - Pass + * `MANUAL` - Manual + - in: query + name: filter[status__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[uid] + schema: + type: string + - in: query + name: filter[uid__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[updated_at] + schema: + type: string + format: date + - in: query + name: include + schema: + type: array + items: + type: string + enum: + - scan + - resources + description: include query parameter to allow the client to customize which + related resources should be returned. + explode: false + - name: sort + required: false + in: query + description: '[list of fields to sort by](https://jsonapi.org/format/#fetching-sorting)' + schema: + type: array + items: + type: string + enum: + - status + - -status + - severity + - -severity + - check_id + - -check_id + - inserted_at + - -inserted_at + - updated_at + - -updated_at + explode: false + tags: + - Finding + security: + - jwtAuth: [] + responses: + '200': + content: + application/vnd.api+json: + schema: + $ref: '#/components/schemas/FindingResponse' + description: '' /api/v1/findings/metadata: get: operationId: findings_metadata_retrieve @@ -1674,6 +2084,392 @@ paths: schema: $ref: '#/components/schemas/FindingMetadataResponse' description: '' + /api/v1/findings/metadata/latest: + get: + operationId: findings_metadata_latest_retrieve + description: Fetch unique metadata values from a set of findings from the latest + scans for each provider. This is useful for dynamic filtering. + summary: Retrieve metadata values from the latest findings + parameters: + - in: query + name: fields[findings-metadata] + schema: + type: array + items: + type: string + enum: + - services + - regions + - resource_types + description: endpoint return only specific fields in the response on a per-type + basis by including a fields[TYPE] query parameter. + explode: false + - in: query + name: filter[check_id] + schema: + type: string + - in: query + name: filter[check_id__icontains] + schema: + type: string + - in: query + name: filter[check_id__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[delta] + schema: + type: string + nullable: true + enum: + - changed + - new + description: |- + * `new` - New + * `changed` - Changed + - in: query + name: filter[delta__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[id] + schema: + type: string + format: uuid + - in: query + name: filter[id__in] + schema: + type: array + items: + type: string + format: uuid + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[impact] + schema: + type: string + enum: + - critical + - high + - informational + - low + - medium + description: |- + * `critical` - Critical + * `high` - High + * `medium` - Medium + * `low` - Low + * `informational` - Informational + - in: query + name: filter[impact__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[muted] + schema: + type: boolean + description: If this filter is not provided, muted and non-muted findings + will be returned. + - in: query + name: filter[provider] + schema: + type: string + format: uuid + - in: query + name: filter[provider__in] + schema: + type: array + items: + type: string + format: uuid + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[provider_alias] + schema: + type: string + - in: query + name: filter[provider_alias__icontains] + schema: + type: string + - in: query + name: filter[provider_alias__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[provider_type] + schema: + type: string + enum: + - aws + - azure + - gcp + - kubernetes + - m365 + description: |- + * `aws` - AWS + * `azure` - Azure + * `gcp` - GCP + * `kubernetes` - Kubernetes + * `m365` - M365 + - in: query + name: filter[provider_type__in] + schema: + type: array + items: + type: string + enum: + - aws + - azure + - gcp + - kubernetes + - m365 + description: |- + Multiple values may be separated by commas. + + * `aws` - AWS + * `azure` - Azure + * `gcp` - GCP + * `kubernetes` - Kubernetes + * `m365` - M365 + explode: false + style: form + - in: query + name: filter[provider_uid] + schema: + type: string + - in: query + name: filter[provider_uid__icontains] + schema: + type: string + - in: query + name: filter[provider_uid__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[region] + schema: + type: string + - in: query + name: filter[region__icontains] + schema: + type: string + - in: query + name: filter[region__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[resource_name] + schema: + type: string + - in: query + name: filter[resource_name__icontains] + schema: + type: string + - in: query + name: filter[resource_name__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[resource_type] + schema: + type: string + - in: query + name: filter[resource_type__icontains] + schema: + type: string + - in: query + name: filter[resource_type__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[resource_uid] + schema: + type: string + - in: query + name: filter[resource_uid__icontains] + schema: + type: string + - in: query + name: filter[resource_uid__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[resources] + schema: + type: array + items: + type: string + format: uuid + description: Multiple values may be separated by commas. + explode: false + style: form + - name: filter[search] + required: false + in: query + description: A search term. + schema: + type: string + - in: query + name: filter[service] + schema: + type: string + - in: query + name: filter[service__icontains] + schema: + type: string + - in: query + name: filter[service__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[severity] + schema: + type: string + enum: + - critical + - high + - informational + - low + - medium + description: |- + * `critical` - Critical + * `high` - High + * `medium` - Medium + * `low` - Low + * `informational` - Informational + - in: query + name: filter[severity__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[status] + schema: + type: string + enum: + - FAIL + - MANUAL + - PASS + description: |- + * `FAIL` - Fail + * `PASS` - Pass + * `MANUAL` - Manual + - in: query + name: filter[status__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[uid] + schema: + type: string + - in: query + name: filter[uid__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[updated_at] + schema: + type: string + format: date + - name: sort + required: false + in: query + description: '[list of fields to sort by](https://jsonapi.org/format/#fetching-sorting)' + schema: + type: array + items: + type: string + enum: + - status + - -status + - severity + - -severity + - check_id + - -check_id + - inserted_at + - -inserted_at + - updated_at + - -updated_at + explode: false + tags: + - Finding + security: + - jwtAuth: [] + responses: + '200': + content: + application/vnd.api+json: + schema: + $ref: '#/components/schemas/FindingMetadataResponse' + description: '' /api/v1/integrations: get: operationId: integrations_list diff --git a/api/src/backend/api/tests/test_views.py b/api/src/backend/api/tests/test_views.py index 91de5775c9..80ab44b946 100644 --- a/api/src/backend/api/tests/test_views.py +++ b/api/src/backend/api/tests/test_views.py @@ -2,7 +2,9 @@ import glob import io import json import os +import tempfile from datetime import datetime, timedelta, timezone +from pathlib import Path from unittest.mock import ANY, MagicMock, Mock, patch import jwt @@ -916,6 +918,26 @@ class TestProviderViewSet: "uid": "8851db6b-42e5-4533-aa9e-30a32d67e875", "alias": "test", }, + { + "provider": "m365", + "uid": "TestingPro.onMirosoft.com", + "alias": "test", + }, + { + "provider": "m365", + "uid": "subdomain.domain.es", + "alias": "test", + }, + { + "provider": "m365", + "uid": "microsoft.net", + "alias": "test", + }, + { + "provider": "m365", + "uid": "subdomain1.subdomain2.subdomain3.subdomain4.domain.net", + "alias": "test", + }, ] ), ) @@ -984,6 +1006,51 @@ class TestProviderViewSet: "invalid_choice", "provider", ), + ( + { + "provider": "m365", + "uid": "https://test.com", + "alias": "test", + }, + "m365-uid", + "uid", + ), + ( + { + "provider": "m365", + "uid": "thisisnotadomain", + "alias": "test", + }, + "m365-uid", + "uid", + ), + ( + { + "provider": "m365", + "uid": "http://test.com", + "alias": "test", + }, + "m365-uid", + "uid", + ), + ( + { + "provider": "m365", + "uid": f"{'a' * 64}.domain.com", + "alias": "test", + }, + "m365-uid", + "uid", + ), + ( + { + "provider": "m365", + "uid": f"subdomain.{'a' * 64}.com", + "alias": "test", + }, + "m365-uid", + "uid", + ), ] ), ) @@ -2318,35 +2385,34 @@ class TestScanViewSet: assert response.status_code == 404 assert response.json()["errors"]["detail"] == "The scan has no reports." - def test_report_local_file( - self, authenticated_client, scans_fixture, tmp_path, monkeypatch - ): - """ - When output_location is a local file path, the view should read the file from disk - and return it with proper headers. - """ + def test_report_local_file(self, authenticated_client, scans_fixture, monkeypatch): scan = scans_fixture[0] - file_content = b"local zip file content" - file_path = tmp_path / "report.zip" - file_path.write_bytes(file_content) + with tempfile.TemporaryDirectory() as tmp: + tmp_path = Path(tmp) + base_tmp = tmp_path / "report_local_file" + base_tmp.mkdir(parents=True, exist_ok=True) - scan.output_location = str(file_path) - scan.state = StateChoices.COMPLETED - scan.save() + file_content = b"local zip file content" + file_path = base_tmp / "report.zip" + file_path.write_bytes(file_content) - monkeypatch.setattr( - glob, - "glob", - lambda pattern: [str(file_path)] if pattern == str(file_path) else [], - ) + scan.output_location = str(file_path) + scan.state = StateChoices.COMPLETED + scan.save() - url = reverse("scan-report", kwargs={"pk": scan.id}) - response = authenticated_client.get(url) - assert response.status_code == 200 - assert response.content == file_content - content_disposition = response.get("Content-Disposition") - assert content_disposition.startswith('attachment; filename="') - assert f'filename="{file_path.name}"' in content_disposition + monkeypatch.setattr( + glob, + "glob", + lambda pattern: [str(file_path)] if pattern == str(file_path) else [], + ) + + url = reverse("scan-report", kwargs={"pk": scan.id}) + response = authenticated_client.get(url) + assert response.status_code == 200 + assert response.content == file_content + content_disposition = response.get("Content-Disposition") + assert content_disposition.startswith('attachment; filename="') + assert f'filename="{file_path.name}"' in content_disposition def test_compliance_invalid_framework(self, authenticated_client, scans_fixture): scan = scans_fixture[0] @@ -2481,31 +2547,36 @@ class TestScanViewSet: ) def test_compliance_local_file( - self, authenticated_client, scans_fixture, tmp_path, monkeypatch + self, authenticated_client, scans_fixture, monkeypatch ): scan = scans_fixture[0] scan.state = StateChoices.COMPLETED - base = tmp_path / "reports" - comp_dir = base / "compliance" - comp_dir.mkdir(parents=True) - fname = comp_dir / "scan_cis.csv" - fname.write_bytes(b"ignored") - scan.output_location = str(base / "scan.zip") - scan.save() + with tempfile.TemporaryDirectory() as tmp: + tmp_path = Path(tmp) + base = tmp_path / "reports" + comp_dir = base / "compliance" + comp_dir.mkdir(parents=True, exist_ok=True) + fname = comp_dir / "scan_cis.csv" + fname.write_bytes(b"ignored") - monkeypatch.setattr( - glob, - "glob", - lambda p: [str(fname)] if p.endswith("*_cis_1.4_aws.csv") else [], - ) + scan.output_location = str(base / "scan.zip") + scan.save() - url = reverse("scan-compliance", kwargs={"pk": scan.id, "name": "cis_1.4_aws"}) - resp = authenticated_client.get(url) - assert resp.status_code == status.HTTP_200_OK - cd = resp["Content-Disposition"] - assert cd.startswith('attachment; filename="') - assert cd.endswith(f'filename="{fname.name}"') + monkeypatch.setattr( + glob, + "glob", + lambda p: [str(fname)] if p.endswith("*_cis_1.4_aws.csv") else [], + ) + + url = reverse( + "scan-compliance", kwargs={"pk": scan.id, "name": "cis_1.4_aws"} + ) + resp = authenticated_client.get(url) + assert resp.status_code == status.HTTP_200_OK + cd = resp["Content-Disposition"] + assert cd.startswith('attachment; filename="') + assert cd.endswith(f'filename="{fname.name}"') @patch("api.v1.views.Task.objects.get") @patch("api.v1.views.TaskSerializer") @@ -3179,6 +3250,29 @@ class TestFindingViewSet: ] } + def test_findings_latest(self, authenticated_client, latest_scan_finding): + response = authenticated_client.get( + reverse("finding-latest"), + ) + assert response.status_code == status.HTTP_200_OK + # The latest scan only has one finding, in comparison with `GET /findings` + assert len(response.json()["data"]) == 1 + assert ( + response.json()["data"][0]["attributes"]["status"] + == latest_scan_finding.status + ) + + def test_findings_metadata_latest(self, authenticated_client, latest_scan_finding): + response = authenticated_client.get( + reverse("finding-metadata_latest"), + ) + assert response.status_code == status.HTTP_200_OK + attributes = response.json()["data"]["attributes"] + + assert attributes["services"] == latest_scan_finding.resource_services + assert attributes["regions"] == latest_scan_finding.resource_regions + assert attributes["resource_types"] == latest_scan_finding.resource_types + @pytest.mark.django_db class TestJWTFields: diff --git a/api/src/backend/api/v1/mixins.py b/api/src/backend/api/v1/mixins.py new file mode 100644 index 0000000000..85250c0eef --- /dev/null +++ b/api/src/backend/api/v1/mixins.py @@ -0,0 +1,33 @@ +from rest_framework.response import Response + + +class PaginateByPkMixin: + """ + Mixin to paginate on a list of PKs (cheaper than heavy JOINs), + re-fetch the full objects with the desired select/prefetch, + re-sort them to preserve DB ordering, then serialize + return. + """ + + def paginate_by_pk( + self, + request, # noqa: F841 + base_queryset, + manager, + select_related: list[str] | None = None, + prefetch_related: list[str] | None = None, + ) -> Response: + pk_list = base_queryset.values_list("id", flat=True) + page = self.paginate_queryset(pk_list) + if page is None: + return Response(self.get_serializer(base_queryset, many=True).data) + + queryset = manager.filter(id__in=page) + if select_related: + queryset = queryset.select_related(*select_related) + if prefetch_related: + queryset = queryset.prefetch_related(*prefetch_related) + + queryset = sorted(queryset, key=lambda obj: page.index(obj.id)) + + serialized = self.get_serializer(queryset, many=True).data + return self.get_paginated_response(serialized) diff --git a/api/src/backend/api/v1/views.py b/api/src/backend/api/v1/views.py index ded955c93a..04810f28df 100644 --- a/api/src/backend/api/v1/views.py +++ b/api/src/backend/api/v1/views.py @@ -65,6 +65,7 @@ from api.filters import ( FindingFilter, IntegrationFilter, InvitationFilter, + LatestFindingFilter, MembershipFilter, ProviderFilter, ProviderGroupFilter, @@ -110,6 +111,7 @@ from api.utils import ( validate_invitation, ) from api.uuid_utils import datetime_to_uuid7, uuid7_start +from api.v1.mixins import PaginateByPkMixin from api.v1.serializers import ( ComplianceOverviewFullSerializer, ComplianceOverviewMetadataSerializer, @@ -1671,10 +1673,24 @@ class ResourceViewSet(BaseRLSViewSet): ], filters=True, ), + latest=extend_schema( + tags=["Finding"], + summary="List the latest findings", + description="Retrieve a list of the latest findings from the latest scans for each provider with options for " + "filtering by various criteria.", + filters=True, + ), + metadata_latest=extend_schema( + tags=["Finding"], + summary="Retrieve metadata values from the latest findings", + description="Fetch unique metadata values from a set of findings from the latest scans for each provider. " + "This is useful for dynamic filtering.", + filters=True, + ), ) @method_decorator(CACHE_DECORATOR, name="list") @method_decorator(CACHE_DECORATOR, name="retrieve") -class FindingViewSet(BaseRLSViewSet): +class FindingViewSet(PaginateByPkMixin, BaseRLSViewSet): queryset = Finding.all_objects.all() serializer_class = FindingSerializer filterset_class = FindingFilter @@ -1706,11 +1722,16 @@ class FindingViewSet(BaseRLSViewSet): def get_serializer_class(self): if self.action == "findings_services_regions": return FindingDynamicFilterSerializer - elif self.action == "metadata": + elif self.action in ["metadata", "metadata_latest"]: return FindingMetadataSerializer return super().get_serializer_class() + def get_filterset_class(self): + if self.action in ["latest", "metadata_latest"]: + return LatestFindingFilter + return FindingFilter + def get_queryset(self): tenant_id = self.request.tenant_id user_roles = get_role(self.request.user) @@ -1750,21 +1771,14 @@ class FindingViewSet(BaseRLSViewSet): return super().filter_queryset(queryset) def list(self, request, *args, **kwargs): - base_qs = self.filter_queryset(self.get_queryset()) - paginated_ids = self.paginate_queryset(base_qs.values_list("id", flat=True)) - if paginated_ids is not None: - ids = list(paginated_ids) - findings = ( - Finding.all_objects.filter(tenant_id=self.request.tenant_id, id__in=ids) - .select_related("scan") - .prefetch_related("resources") - ) - # Re-sort in Python to preserve ordering: - findings = sorted(findings, key=lambda x: ids.index(x.id)) - serializer = self.get_serializer(findings, many=True) - return self.get_paginated_response(serializer.data) - serializer = self.get_serializer(base_qs, many=True) - return Response(serializer.data) + filtered_queryset = self.filter_queryset(self.get_queryset()) + return self.paginate_by_pk( + request, + filtered_queryset, + manager=Finding.all_objects, + select_related=["scan"], + prefetch_related=["resources"], + ) @action(detail=False, methods=["get"], url_name="findings_services_regions") def findings_services_regions(self, request): @@ -1897,6 +1911,107 @@ class FindingViewSet(BaseRLSViewSet): serializer.is_valid(raise_exception=True) return Response(serializer.data) + @action(detail=False, methods=["get"], url_name="latest") + def latest(self, request): + tenant_id = request.tenant_id + filtered_queryset = self.filter_queryset(self.get_queryset()) + + latest_scan_ids = ( + Scan.all_objects.filter(tenant_id=tenant_id, state=StateChoices.COMPLETED) + .order_by("provider_id", "-inserted_at") + .distinct("provider_id") + .values_list("id", flat=True) + ) + filtered_queryset = filtered_queryset.filter( + tenant_id=tenant_id, scan_id__in=latest_scan_ids + ) + + return self.paginate_by_pk( + request, + filtered_queryset, + manager=Finding.all_objects, + select_related=["scan"], + prefetch_related=["resources"], + ) + + @action( + detail=False, + methods=["get"], + url_name="metadata_latest", + url_path="metadata/latest", + ) + def metadata_latest(self, request): + tenant_id = request.tenant_id + query_params = request.query_params + + latest_scans_queryset = ( + Scan.all_objects.filter(tenant_id=tenant_id, state=StateChoices.COMPLETED) + .order_by("provider_id", "-inserted_at") + .distinct("provider_id") + ) + latest_scans_ids = list(latest_scans_queryset.values_list("id", flat=True)) + + queryset = ResourceScanSummary.objects.filter( + tenant_id=tenant_id, + scan_id__in=latest_scans_queryset.values_list("id", flat=True), + ) + # ToRemove: Temporary fallback mechanism + present_ids = set( + ResourceScanSummary.objects.filter( + tenant_id=tenant_id, scan_id__in=latest_scans_ids + ) + .values_list("scan_id", flat=True) + .distinct() + ) + missing_scan_ids = [sid for sid in latest_scans_ids if sid not in present_ids] + if missing_scan_ids: + for scan_id in missing_scan_ids: + backfill_scan_resource_summaries_task.apply_async( + kwargs={"tenant_id": tenant_id, "scan_id": scan_id} + ) + return Response( + get_findings_metadata_no_aggregations( + tenant_id, self.filter_queryset(self.get_queryset()) + ) + ) + + if service_filter := query_params.get("filter[service]") or query_params.get( + "filter[service__in]" + ): + queryset = queryset.filter(service__in=service_filter.split(",")) + if region_filter := query_params.get("filter[region]") or query_params.get( + "filter[region__in]" + ): + queryset = queryset.filter(region__in=region_filter.split(",")) + if resource_type_filter := query_params.get( + "filter[resource_type]" + ) or query_params.get("filter[resource_type__in]"): + queryset = queryset.filter( + resource_type__in=resource_type_filter.split(",") + ) + + services = list( + queryset.values_list("service", flat=True).distinct().order_by("service") + ) + regions = list( + queryset.values_list("region", flat=True).distinct().order_by("region") + ) + resource_types = list( + queryset.values_list("resource_type", flat=True) + .distinct() + .order_by("resource_type") + ) + + result = { + "services": services, + "regions": regions, + "resource_types": resource_types, + } + + serializer = self.get_serializer(data=result) + serializer.is_valid(raise_exception=True) + return Response(serializer.data) + @extend_schema_view( list=extend_schema( diff --git a/api/src/backend/conftest.py b/api/src/backend/conftest.py index 2fba4cebb7..8f58c447de 100644 --- a/api/src/backend/conftest.py +++ b/api/src/backend/conftest.py @@ -929,6 +929,47 @@ def backfill_scan_metadata_fixture(scans_fixture, findings_fixture): backfill_resource_scan_summaries(tenant_id=tenant_id, scan_id=scan_id) +@pytest.fixture(scope="function") +def latest_scan_finding(authenticated_client, providers_fixture, resources_fixture): + provider = providers_fixture[0] + tenant_id = str(providers_fixture[0].tenant_id) + resource = resources_fixture[0] + scan = Scan.objects.create( + name="latest completed scan", + provider=provider, + trigger=Scan.TriggerChoices.MANUAL, + state=StateChoices.COMPLETED, + tenant_id=tenant_id, + ) + finding = Finding.objects.create( + tenant_id=tenant_id, + uid="test_finding_uid_1", + scan=scan, + delta="new", + status=Status.FAIL, + status_extended="test status extended ", + impact=Severity.critical, + impact_extended="test impact extended one", + severity=Severity.critical, + raw_result={ + "status": Status.FAIL, + "impact": Severity.critical, + "severity": Severity.critical, + }, + tags={"test": "dev-qa"}, + check_id="test_check_id", + check_metadata={ + "CheckId": "test_check_id", + "Description": "test description apple sauce", + }, + first_seen_at="2024-01-02T00:00:00Z", + ) + + finding.add_resources([resource]) + backfill_resource_scan_summaries(tenant_id, str(scan.id)) + return finding + + def get_authorization_header(access_token: str) -> dict: return {"Authorization": f"Bearer {access_token}"} diff --git a/api/src/backend/tasks/jobs/export.py b/api/src/backend/tasks/jobs/export.py index fb405176d5..2bda9d6def 100644 --- a/api/src/backend/tasks/jobs/export.py +++ b/api/src/backend/tasks/jobs/export.py @@ -45,6 +45,9 @@ from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore_azur from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore_gcp import ( ProwlerThreatScoreGCP, ) +from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore_m365 import ( + ProwlerThreatScoreM365, +) from prowler.lib.outputs.csv.csv import CSV from prowler.lib.outputs.html.html import HTML from prowler.lib.outputs.ocsf.ocsf import OCSF @@ -85,6 +88,7 @@ COMPLIANCE_CLASS_MAP = { ], "m365": [ (lambda name: name.startswith("cis_"), M365CIS), + (lambda name: name == "prowler_threatscore_m365", ProwlerThreatScoreM365), ], } diff --git a/api/src/backend/tasks/tests/test_export.py b/api/src/backend/tasks/tests/test_export.py index 2aefbce9f9..6811fe7449 100644 --- a/api/src/backend/tasks/tests/test_export.py +++ b/api/src/backend/tasks/tests/test_export.py @@ -1,5 +1,6 @@ import os import zipfile +from pathlib import Path from unittest.mock import MagicMock, patch import pytest @@ -14,8 +15,9 @@ from tasks.jobs.export import ( @pytest.mark.django_db class TestOutputs: - def test_compress_output_files_creates_zip(self, tmp_path): - output_dir = tmp_path / "output" + def test_compress_output_files_creates_zip(self, tmpdir): + base_tmp = Path(str(tmpdir.mkdir("compress_output"))) + output_dir = base_tmp / "output" output_dir.mkdir() file_path = output_dir / "result.csv" file_path.write_text("data") @@ -54,16 +56,16 @@ class TestOutputs: @patch("tasks.jobs.export.get_s3_client") @patch("tasks.jobs.export.base") - def test_upload_to_s3_success(self, mock_base, mock_get_client, tmp_path): + def test_upload_to_s3_success(self, mock_base, mock_get_client, tmpdir): mock_base.DJANGO_OUTPUT_S3_AWS_OUTPUT_BUCKET = "test-bucket" - zip_path = tmp_path / "outputs.zip" + base_tmp = Path(str(tmpdir.mkdir("upload_success"))) + zip_path = base_tmp / "outputs.zip" zip_path.write_bytes(b"dummy") - compliance_dir = tmp_path / "compliance" + compliance_dir = base_tmp / "compliance" compliance_dir.mkdir() - compliance_file = compliance_dir / "report.csv" - compliance_file.write_text("ok") + (compliance_dir / "report.csv").write_text("ok") client_mock = MagicMock() mock_get_client.return_value = client_mock @@ -72,7 +74,6 @@ class TestOutputs: expected_uri = "s3://test-bucket/tenant-id/scan-id/outputs.zip" assert result == expected_uri - assert client_mock.upload_file.call_count == 2 @patch("tasks.jobs.export.get_s3_client") @@ -84,12 +85,14 @@ class TestOutputs: @patch("tasks.jobs.export.get_s3_client") @patch("tasks.jobs.export.base") - def test_upload_to_s3_skips_non_files(self, mock_base, mock_get_client, tmp_path): + def test_upload_to_s3_skips_non_files(self, mock_base, mock_get_client, tmpdir): mock_base.DJANGO_OUTPUT_S3_AWS_OUTPUT_BUCKET = "test-bucket" - zip_path = tmp_path / "results.zip" + base_tmp = Path(str(tmpdir.mkdir("upload_skips_non_files"))) + + zip_path = base_tmp / "results.zip" zip_path.write_bytes(b"zip") - compliance_dir = tmp_path / "compliance" + compliance_dir = base_tmp / "compliance" compliance_dir.mkdir() (compliance_dir / "subdir").mkdir() @@ -100,7 +103,6 @@ class TestOutputs: expected_uri = "s3://test-bucket/tenant/scan/results.zip" assert result == expected_uri - client_mock.upload_file.assert_called_once() @patch( @@ -110,23 +112,26 @@ class TestOutputs: @patch("tasks.jobs.export.base") @patch("tasks.jobs.export.logger.error") def test_upload_to_s3_failure_logs_error( - self, mock_logger, mock_base, mock_get_client, tmp_path + self, mock_logger, mock_base, mock_get_client, tmpdir ): mock_base.DJANGO_OUTPUT_S3_AWS_OUTPUT_BUCKET = "bucket" - zip_path = tmp_path / "zipfile.zip" + + base_tmp = Path(str(tmpdir.mkdir("upload_failure_logs"))) + zip_path = base_tmp / "zipfile.zip" zip_path.write_bytes(b"zip") - compliance_dir = tmp_path / "compliance" + compliance_dir = base_tmp / "compliance" compliance_dir.mkdir() (compliance_dir / "report.csv").write_text("csv") _upload_to_s3("tenant", str(zip_path), "scan") mock_logger.assert_called() - def test_generate_output_directory_creates_paths(self, tmp_path): + def test_generate_output_directory_creates_paths(self, tmpdir): from prowler.config.config import output_file_timestamp - base_dir = str(tmp_path) + base_tmp = Path(str(tmpdir.mkdir("generate_output"))) + base_dir = str(base_tmp) tenant_id = "t1" scan_id = "s1" provider = "aws" diff --git a/dashboard/compliance/cis_5_0_aws.py b/dashboard/compliance/cis_5_0_aws.py new file mode 100644 index 0000000000..94558f33ad --- /dev/null +++ b/dashboard/compliance/cis_5_0_aws.py @@ -0,0 +1,24 @@ +import warnings + +from dashboard.common_methods import get_section_containers_cis + +warnings.filterwarnings("ignore") + + +def get_table(data): + aux = data[ + [ + "REQUIREMENTS_ID", + "REQUIREMENTS_DESCRIPTION", + "REQUIREMENTS_ATTRIBUTES_SECTION", + "CHECKID", + "STATUS", + "REGION", + "ACCOUNTID", + "RESOURCEID", + ] + ].copy() + + return get_section_containers_cis( + aux, "REQUIREMENTS_ID", "REQUIREMENTS_ATTRIBUTES_SECTION" + ) diff --git a/docs/getting-started/requirements.md b/docs/getting-started/requirements.md index d9e325b911..9e8e9eb5b1 100644 --- a/docs/getting-started/requirements.md +++ b/docs/getting-started/requirements.md @@ -467,3 +467,19 @@ The required modules are: - [ExchangeOnlineManagement](https://www.powershellgallery.com/packages/ExchangeOnlineManagement/3.6.0): Minimum version 3.6.0. Required for several checks across Exchange, Defender, and Purview. - [MicrosoftTeams](https://www.powershellgallery.com/packages/MicrosoftTeams/6.6.0): Minimum version 6.6.0. Required for all Teams checks. + +## GitHub +### Authentication + +Prowler supports multiple methods to [authenticate with GitHub](https://docs.github.com/en/rest/authentication/authenticating-to-the-rest-api). These include: + +- **Personal Access Token (PAT)** +- **OAuth App Token** +- **GitHub App Credentials** + +This flexibility allows you to scan and analyze your GitHub account, including repositories, organizations, and applications, using the method that best suits your use case. + +The provided credentials must have the appropriate permissions to perform all the required checks. + +???+ note + GitHub App Credentials support less checks than other authentication methods. diff --git a/docs/index.md b/docs/index.md index a92d4b0444..ff0f3237a2 100644 --- a/docs/index.md +++ b/docs/index.md @@ -565,6 +565,7 @@ kubectl logs prowler-XXXXX --namespace prowler-ns ???+ note By default, `prowler` will scan all namespaces in your active Kubernetes context. Use the flag `--context` to specify the context to be scanned and `--namespaces` to specify the namespaces to be scanned. + #### Microsoft 365 With M365 you need to specify which auth method is going to be used: @@ -587,5 +588,29 @@ prowler m365 --browser-auth --tenant-id "XXXXXXXX" See more details about M365 Authentication in [Requirements](getting-started/requirements.md#microsoft-365) +#### GitHub + +Prowler allows you to scan your GitHub account, including your repositories, organizations or applications. + +There are several supported login methods: + +```console +# Personal Access Token (PAT): +prowler github --personal-access-token pat + +# OAuth App Token: +prowler github --oauth-app-token oauth_token + +# GitHub App Credentials: +prowler github --github-app-id app_id --github-app-key app_key +``` + +???+ note + If no login method is explicitly provided, Prowler will automatically attempt to authenticate using environment variables in the following order of precedence: + + 1. `GITHUB_PERSONAL_ACCESS_TOKEN` + 2. `OAUTH_APP_TOKEN` + 3. `GITHUB_APP_ID` and `GITHUB_APP_KEY` + ## Prowler v2 Documentation For **Prowler v2 Documentation**, please check it out [here](https://github.com/prowler-cloud/prowler/blob/8818f47333a0c1c1a457453c87af0ea5b89a385f/README.md). diff --git a/docs/tutorials/github/authentication.md b/docs/tutorials/github/authentication.md new file mode 100644 index 0000000000..29f7795aba --- /dev/null +++ b/docs/tutorials/github/authentication.md @@ -0,0 +1,44 @@ +# GitHub Authentication + +Prowler supports multiple methods to [authenticate with GitHub](https://docs.github.com/en/rest/authentication/authenticating-to-the-rest-api). These include: + +- **Personal Access Token (PAT)** +- **OAuth App Token** +- **GitHub App Credentials** + +This flexibility allows you to scan and analyze your GitHub account, including repositories, organizations, and applications, using the method that best suits your use case. + +## Supported Login Methods + +Here are the available login methods and their respective flags: + +### Personal Access Token (PAT) +Use this method by providing your personal access token directly. + +```console +prowler github --personal-access-token pat +``` + +### OAuth App Token +Authenticate using an OAuth app token. + +```console +prowler github --oauth-app-token oauth_token +``` + +### GitHub App Credentials +Use GitHub App credentials by specifying the App ID and the private key. + +```console +prowler github --github-app-id app_id --github-app-key app_key +``` + +### Automatic Login Method Detection +If no login method is explicitly provided, Prowler will automatically attempt to authenticate using environment variables in the following order of precedence: + +1. `GITHUB_PERSONAL_ACCESS_TOKEN` +2. `OAUTH_APP_TOKEN` +3. `GITHUB_APP_ID` and `GITHUB_APP_KEY` + +???+ note + Ensure the corresponding environment variables are set up before running Prowler for automatic detection if you don't plan to specify the login method. diff --git a/docs/tutorials/misc.md b/docs/tutorials/misc.md index 5b17592548..2f646aab10 100644 --- a/docs/tutorials/misc.md +++ b/docs/tutorials/misc.md @@ -38,11 +38,11 @@ prowler --list-checks ``` - Execute specific check(s): ```console -prowler -c/--checks s3_bucket_public_access +prowler -c/--checks s3_bucket_public_access iam_root_mfa_enabled ``` - Exclude specific check(s): ```console -prowler -e/--excluded-checks ec2 rds +prowler -e/--excluded-checks s3_bucket_public_access iam_root_mfa_enabled ``` - Execute checks that appears in a json file: ```json diff --git a/poetry.lock b/poetry.lock index 2734a604dd..01c3b39bd3 100644 --- a/poetry.lock +++ b/poetry.lock @@ -3969,6 +3969,32 @@ cffi = ">=1.4.1" docs = ["sphinx (>=1.6.5)", "sphinx-rtd-theme"] tests = ["hypothesis (>=3.27.0)", "pytest (>=3.2.1,!=3.3.0)"] +[[package]] +name = "pynacl" +version = "1.5.0" +description = "Python binding to the Networking and Cryptography (NaCl) library" +optional = false +python-versions = ">=3.6" +files = [ + {file = "PyNaCl-1.5.0-cp36-abi3-macosx_10_10_universal2.whl", hash = "sha256:401002a4aaa07c9414132aaed7f6836ff98f59277a234704ff66878c2ee4a0d1"}, + {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:52cb72a79269189d4e0dc537556f4740f7f0a9ec41c1322598799b0bdad4ef92"}, + {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a36d4a9dda1f19ce6e03c9a784a2921a4b726b02e1c736600ca9c22029474394"}, + {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:0c84947a22519e013607c9be43706dd42513f9e6ae5d39d3613ca1e142fba44d"}, + {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:06b8f6fa7f5de8d5d2f7573fe8c863c051225a27b61e6860fd047b1775807858"}, + {file = "PyNaCl-1.5.0-cp36-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:a422368fc821589c228f4c49438a368831cb5bbc0eab5ebe1d7fac9dded6567b"}, + {file = "PyNaCl-1.5.0-cp36-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:61f642bf2378713e2c2e1de73444a3778e5f0a38be6fee0fe532fe30060282ff"}, + {file = "PyNaCl-1.5.0-cp36-abi3-win32.whl", hash = "sha256:e46dae94e34b085175f8abb3b0aaa7da40767865ac82c928eeb9e57e1ea8a543"}, + {file = "PyNaCl-1.5.0-cp36-abi3-win_amd64.whl", hash = "sha256:20f42270d27e1b6a29f54032090b972d97f0a1b0948cc52392041ef7831fee93"}, + {file = "PyNaCl-1.5.0.tar.gz", hash = "sha256:8ac7448f09ab85811607bdd21ec2464495ac8b7c66d146bf545b0f08fb9220ba"}, +] + +[package.dependencies] +cffi = ">=1.4.1" + +[package.extras] +docs = ["sphinx (>=1.6.5)", "sphinx-rtd-theme"] +tests = ["hypothesis (>=3.27.0)", "pytest (>=3.2.1,!=3.3.0)"] + [[package]] name = "pyparsing" version = "3.2.3" diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 980e2d9dfc..93f1439904 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -10,10 +10,25 @@ All notable changes to the **Prowler SDK** are documented in this file. - Add Prowler ThreatScore for M365 provider. [(#7692)](https://github.com/prowler-cloud/prowler/pull/7692) - Add new check `defender_domain_spf_records_published`. [(#7724)](https://github.com/prowler-cloud/prowler/pull/7724) - Add GitHub provider. [(#5787)](https://github.com/prowler-cloud/prowler/pull/5787) +- Add `repository_default_branch_requires_multiple_approvals` check for GitHub provider. [(#6160)](https://github.com/prowler-cloud/prowler/pull/6160) +- Add `repository_default_branch_protection_enabled` check for GitHub provider. [(#6161)](https://github.com/prowler-cloud/prowler/pull/6161) +- Add `repository_default_branch_requires_linear_history` check for GitHub provider. [(#6162)](https://github.com/prowler-cloud/prowler/pull/6162) +- Add `repository_default_branch_disallows_force_push` check for GitHub provider. [(#6197)](https://github.com/prowler-cloud/prowler/pull/6197) +- Add `repository_default_branch_deletion_disabled` check for GitHub provider. [(#6200)](https://github.com/prowler-cloud/prowler/pull/6200) +- Add `repository_default_branch_status_checks_required` check for GitHub provider. [(#6204)](https://github.com/prowler-cloud/prowler/pull/6204) +- Add `repository_default_branch_protection_applies_to_admins` check for GitHub provider. [(#6205)](https://github.com/prowler-cloud/prowler/pull/6205) +- Add `repository_branch_delete_on_merge_enabled` check for GitHub provider. [(#6209)](https://github.com/prowler-cloud/prowler/pull/6209) +- Add `repository_default_branch_requires_conversation_resolution` check for GitHub provider. [(#6208)](https://github.com/prowler-cloud/prowler/pull/6208) +- Add `organization_members_mfa_required` check for GitHub provider. [(#6304)](https://github.com/prowler-cloud/prowler/pull/6304) +- Add GitHub provider documentation and CIS v1.0.0 compliance. [(#6116)](https://github.com/prowler-cloud/prowler/pull/6116) +- Add CIS 5.0 compliance framework for AWS. [(7766)](https://github.com/prowler-cloud/prowler/pull/7766) ### Fixed - Update CIS 4.0 for M365 provider. [(#7699)](https://github.com/prowler-cloud/prowler/pull/7699) - Enhance defender policies checks logic. [(#7719)](https://github.com/prowler-cloud/prowler/pull/7719) +- Update and upgrade CIS for all the providers [(#7738)](https://github.com/prowler-cloud/prowler/pull/7738) +- Cover policies with conditions with SNS endpoint in `sns_topics_not_publicly_accessible`. [(#7750)](https://github.com/prowler-cloud/prowler/pull/7750) +- Change severity logic for `ec2_securitygroup_allow_ingress_from_internet_to_all_ports` check. [(#7764)](https://github.com/prowler-cloud/prowler/pull/7764) --- diff --git a/prowler/__main__.py b/prowler/__main__.py index 95b08d6a15..e22d7b7fa6 100644 --- a/prowler/__main__.py +++ b/prowler/__main__.py @@ -50,6 +50,7 @@ from prowler.lib.outputs.compliance.aws_well_architected.aws_well_architected im from prowler.lib.outputs.compliance.cis.cis_aws import AWSCIS from prowler.lib.outputs.compliance.cis.cis_azure import AzureCIS from prowler.lib.outputs.compliance.cis.cis_gcp import GCPCIS +from prowler.lib.outputs.compliance.cis.cis_github import GithubCIS from prowler.lib.outputs.compliance.cis.cis_kubernetes import KubernetesCIS from prowler.lib.outputs.compliance.cis.cis_m365 import M365CIS from prowler.lib.outputs.compliance.compliance import display_compliance_table @@ -787,6 +788,35 @@ def prowler(): generated_outputs["compliance"].append(generic_compliance) generic_compliance.batch_write_data_to_file() + elif provider == "github": + for compliance_name in input_compliance_frameworks: + if compliance_name.startswith("cis_"): + # Generate CIS Finding Object + filename = ( + f"{output_options.output_directory}/compliance/" + f"{output_options.output_filename}_{compliance_name}.csv" + ) + cis = GithubCIS( + findings=finding_outputs, + compliance=bulk_compliance_frameworks[compliance_name], + file_path=filename, + ) + generated_outputs["compliance"].append(cis) + cis.batch_write_data_to_file() + else: + filename = ( + f"{output_options.output_directory}/compliance/" + f"{output_options.output_filename}_{compliance_name}.csv" + ) + generic_compliance = GenericCompliance( + findings=finding_outputs, + compliance=bulk_compliance_frameworks[compliance_name], + create_file_descriptor=True, + file_path=filename, + ) + generated_outputs["compliance"].append(generic_compliance) + generic_compliance.batch_write_data_to_file() + # AWS Security Hub Integration if provider == "aws": # Send output to S3 if needed (-B / -D) for all the output formats diff --git a/prowler/compliance/aws/cis_1.4_aws.json b/prowler/compliance/aws/cis_1.4_aws.json index 584ca284c6..0e6d1f136c 100644 --- a/prowler/compliance/aws/cis_1.4_aws.json +++ b/prowler/compliance/aws/cis_1.4_aws.json @@ -12,7 +12,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.", @@ -33,7 +33,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.", @@ -54,7 +54,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS console defaults to no check boxes selected when creating a new IAM user. When cerating the IAM User credentials you have to determine what type of access they require. Programmatic access: The IAM user might need to make API calls, use the AWS CLI, or use the Tools for Windows PowerShell. In that case, create an access key (access key ID and a secret access key) for that user. AWS Management Console access: If the user needs to access the AWS Management Console, create a password for the user.", @@ -76,7 +76,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.", @@ -97,7 +97,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)", @@ -118,7 +118,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be regularly rotated.", @@ -139,7 +139,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM users are granted access to services, functions, and data through IAM policies. There are three ways to define policies for a user: 1) Edit the user policy directly, aka an inline, or user, policy; 2) attach a policy directly to a user; 3) add the user to an IAM group that has an attached policy. Only the third implementation is recommended.", @@ -161,7 +161,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered a standard security advice to grant _least privilege_ -that is, granting only the permissions required to perform a task. Determine what users need to do and then craft policies for them that let the users perform _only_ those tasks, instead of allowing full administrative privileges.", @@ -182,7 +182,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support.", @@ -203,7 +203,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. \"AWS Access\" means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.", @@ -224,7 +224,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use ACM or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.", @@ -245,7 +245,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.", @@ -266,7 +266,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable IAM Access analyzer for IAM policies about all resources in each region. IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. So the results allow you to determine if an unintended user is allowed, making it easier for administrators to monitor least privileges access. Access Analyzer analyzes only policies that are applied to resources in the same AWS Region.", @@ -287,7 +287,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.", @@ -308,7 +308,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established.", @@ -329,7 +329,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be removed.", @@ -350,7 +350,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device. **Note:** When virtual MFA is used for 'root' accounts, it is recommended that the device used is NOT a personal device, but rather a dedicated mobile device (tablet or phone) that is managed to be kept charged and secured independent of any individual personal devices. (\"non-personal virtual MFA\") This lessens the risks of losing access to the MFA due to device loss, device trade-in or if the individual owning the device is no longer employed at the company.", @@ -371,7 +371,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the 'root' user account be protected with a hardware MFA.", @@ -392,7 +392,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. That user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.", @@ -413,7 +413,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure password are at least a given length. It is recommended that the password policy require a minimum password length 14.", @@ -434,7 +434,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords.", @@ -455,8 +455,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Amazon S3 provides a variety of no, or low, cost encryption options to protect data at rest.", @@ -477,8 +477,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "At the Amazon S3 bucket level, you can configure permissions through a bucket policy making the objects accessible only through HTTPS.", @@ -499,8 +499,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.", @@ -521,8 +521,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.", @@ -544,8 +544,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Amazon S3 provides `Block public access (bucket settings)` and `Block public access (account settings)` to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, `Block public access (bucket settings)` prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, `Block public access (account settings)` prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.", @@ -566,7 +566,7 @@ ], "Attributes": [ { - "Section": "2. Storage", + "Section": "2 Storage", "SubSection": "2.2. Elastic Compute Cloud (EC2)", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -589,8 +589,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.3. Relational Database Service (RDS)", + "Section": "2 Storage", + "SubSection": "2.3 Relational Database Service (RDS)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Amazon RDS encrypted DB instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles authentication of access and decryption of your data transparently with a minimal impact on performance.", @@ -611,7 +611,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).", @@ -632,7 +632,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.", @@ -653,7 +653,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.", @@ -674,7 +674,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.", @@ -695,7 +695,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "CloudTrail logs a record of every API call made in your AWS account. These logs file are stored in an S3 bucket. It is recommended that the bucket policy or access control list (ACL) applied to the S3 bucket that CloudTrail logs to prevent public access to the CloudTrail logs.", @@ -716,7 +716,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls made in a given AWS account. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail uses Amazon S3 for log file storage and delivery, so log files are stored durably. In addition to capturing CloudTrail logs within a specified S3 bucket for long term analysis, realtime analysis can be performed by configuring CloudTrail to send logs to CloudWatch Logs. For a trail that is enabled in all regions in an account, CloudTrail sends log files from all those regions to a CloudWatch Logs log group. It is recommended that CloudTrail logs be sent to CloudWatch Logs. Note: The intent of this recommendation is to ensure AWS account activity is being captured, monitored, and appropriately alarmed on. CloudWatch Logs is a native way to accomplish this using AWS services but does not preclude the use of an alternate solution.", @@ -737,7 +737,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration item (AWS resource), relationships between configuration items (AWS resources), any configuration changes between resources. It is recommended AWS Config be enabled in all regions.", @@ -758,7 +758,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.", @@ -779,7 +779,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.", @@ -800,7 +800,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS which is tied to the key ID of the Customer Created customer master key (CMK). It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation can not be enabled for any asymmetric CMK.", @@ -821,7 +821,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet \"Rejects\" for VPCs.", @@ -842,7 +842,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.", @@ -863,7 +863,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Security Groups are a stateful packet filter that controls ingress and egress traffic within a VPC. It is recommended that a metric filter and alarm be established for detecting changes to Security Groups.", @@ -884,7 +884,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. NACLs are used as a stateless packet filter to control ingress and egress traffic for subnets within a VPC. It is recommended that a metric filter and alarm be established for changes made to NACLs.", @@ -905,7 +905,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Network gateways are required to send/receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.", @@ -926,7 +926,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Routing tables are used to route network traffic between subnets and to network gateways. It is recommended that a metric filter and alarm be established for changes to route tables.", @@ -947,7 +947,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is possible to have more than 1 VPC within an account, in addition it is also possible to create a peer connection between 2 VPCs enabling network traffic to route between VPCs. It is recommended that a metric filter and alarm be established for changes made to VPCs.", @@ -968,7 +968,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizations changes made in the master AWS Account.", @@ -989,7 +989,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for console logins that are not protected by multi-factor authentication (MFA).", @@ -1010,7 +1010,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for 'root' login attempts.", @@ -1031,7 +1031,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established changes made to Identity and Access Management (IAM) policies.", @@ -1052,7 +1052,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.", @@ -1073,7 +1073,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for failed console authentication attempts.", @@ -1094,7 +1094,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for customer created CMKs which have changed state to disabled or scheduled deletion.", @@ -1115,7 +1115,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes to S3 bucket policies.", @@ -1136,7 +1136,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.", @@ -1159,7 +1159,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1182,7 +1182,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1203,7 +1203,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If you don't specify a security group when you launch an instance, the instance is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic. The default VPC in every region should have its default security group updated to comply. Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation. **NOTE:** When implementing this recommendation, VPC flow logging is invaluable in determining the least privilege port access required by systems to work properly because it can log all packet acceptances and rejections occurring under the current security groups. This dramatically reduces the primary barrier to least privilege engineering - discovering the minimum ports required by systems in the environment. Even if the VPC flow logging recommendation in this benchmark is not adopted as a permanent security measure, it should be used during any period of discovery and engineering for least privileged security groups.", @@ -1224,7 +1224,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection.", diff --git a/prowler/compliance/aws/cis_1.5_aws.json b/prowler/compliance/aws/cis_1.5_aws.json index 90ca3742e4..8c3d9a25a1 100644 --- a/prowler/compliance/aws/cis_1.5_aws.json +++ b/prowler/compliance/aws/cis_1.5_aws.json @@ -12,7 +12,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.", @@ -33,7 +33,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.", @@ -54,7 +54,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS console defaults to no check boxes selected when creating a new IAM user. When cerating the IAM User credentials you have to determine what type of access they require. Programmatic access: The IAM user might need to make API calls, use the AWS CLI, or use the Tools for Windows PowerShell. In that case, create an access key (access key ID and a secret access key) for that user. AWS Management Console access: If the user needs to access the AWS Management Console, create a password for the user.", @@ -76,7 +76,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.", @@ -97,7 +97,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)", @@ -118,7 +118,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be regularly rotated.", @@ -139,7 +139,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM users are granted access to services, functions, and data through IAM policies. There are three ways to define policies for a user: 1) Edit the user policy directly, aka an inline, or user, policy; 2) attach a policy directly to a user; 3) add the user to an IAM group that has an attached policy. Only the third implementation is recommended.", @@ -161,7 +161,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered a standard security advice to grant _least privilege_ -that is, granting only the permissions required to perform a task. Determine what users need to do and then craft policies for them that let the users perform _only_ those tasks, instead of allowing full administrative privileges.", @@ -182,7 +182,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support.", @@ -203,7 +203,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. \"AWS Access\" means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.", @@ -224,7 +224,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use ACM or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.", @@ -245,7 +245,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.", @@ -266,7 +266,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable IAM Access analyzer for IAM policies about all resources in each region. IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. So the results allow you to determine if an unintended user is allowed, making it easier for administrators to monitor least privileges access. Access Analyzer analyzes only policies that are applied to resources in the same AWS Region.", @@ -287,7 +287,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.", @@ -308,7 +308,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established.", @@ -329,7 +329,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be removed.", @@ -350,7 +350,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device. **Note:** When virtual MFA is used for 'root' accounts, it is recommended that the device used is NOT a personal device, but rather a dedicated mobile device (tablet or phone) that is managed to be kept charged and secured independent of any individual personal devices. (\"non-personal virtual MFA\") This lessens the risks of losing access to the MFA due to device loss, device trade-in or if the individual owning the device is no longer employed at the company.", @@ -371,7 +371,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the 'root' user account be protected with a hardware MFA.", @@ -392,7 +392,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. That user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.", @@ -413,7 +413,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure password are at least a given length. It is recommended that the password policy require a minimum password length 14.", @@ -434,7 +434,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords.", @@ -455,8 +455,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Amazon S3 provides a variety of no, or low, cost encryption options to protect data at rest.", @@ -477,8 +477,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "At the Amazon S3 bucket level, you can configure permissions through a bucket policy making the objects accessible only through HTTPS.", @@ -499,8 +499,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.", @@ -521,8 +521,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.", @@ -544,8 +544,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Amazon S3 provides `Block public access (bucket settings)` and `Block public access (account settings)` to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, `Block public access (bucket settings)` prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, `Block public access (account settings)` prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.", @@ -566,8 +566,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.2. Elastic Compute Cloud (EC2)", + "Section": "2 Storage", + "SubSection": "2.2 Elastic Compute Cloud (EC2)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service. While disabled by default, forcing encryption at EBS volume creation is supported.", @@ -589,8 +589,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.3. Relational Database Service (RDS)", + "Section": "2 Storage", + "SubSection": "2.3 Relational Database Service (RDS)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Amazon RDS encrypted DB instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles authentication of access and decryption of your data transparently with a minimal impact on performance.", @@ -611,8 +611,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.3. Relational Database Service (RDS)", + "Section": "2 Storage", + "SubSection": "2.3 Relational Database Service (RDS)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance window. So, RDS instances can get the new features, bug fixes, and security patches for their database engines.", @@ -633,8 +633,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.3. Relational Database Service (RDS)", + "Section": "2 Storage", + "SubSection": "2.3 Relational Database Service (RDS)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure and verify that RDS database instances provisioned in your AWS account do restrict unauthorized access in order to minimize security risks. To restrict access to any publicly accessible RDS database instance, you must disable the database Publicly Accessible flag and update the VPC security group associated with the instance.", @@ -655,7 +655,7 @@ ], "Attributes": [ { - "Section": "2. Storage", + "Section": "2 Storage", "SubSection": "2.4 Elastic File System (EFS)", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -677,7 +677,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).", @@ -698,7 +698,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.", @@ -719,7 +719,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.", @@ -740,7 +740,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.", @@ -761,7 +761,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "CloudTrail logs a record of every API call made in your AWS account. These logs file are stored in an S3 bucket. It is recommended that the bucket policy or access control list (ACL) applied to the S3 bucket that CloudTrail logs to prevent public access to the CloudTrail logs.", @@ -782,7 +782,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls made in a given AWS account. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail uses Amazon S3 for log file storage and delivery, so log files are stored durably. In addition to capturing CloudTrail logs within a specified S3 bucket for long term analysis, realtime analysis can be performed by configuring CloudTrail to send logs to CloudWatch Logs. For a trail that is enabled in all regions in an account, CloudTrail sends log files from all those regions to a CloudWatch Logs log group. It is recommended that CloudTrail logs be sent to CloudWatch Logs. Note: The intent of this recommendation is to ensure AWS account activity is being captured, monitored, and appropriately alarmed on. CloudWatch Logs is a native way to accomplish this using AWS services but does not preclude the use of an alternate solution.", @@ -803,7 +803,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration item (AWS resource), relationships between configuration items (AWS resources), any configuration changes between resources. It is recommended AWS Config be enabled in all regions.", @@ -824,7 +824,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.", @@ -845,7 +845,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.", @@ -866,7 +866,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS which is tied to the key ID of the Customer Created customer master key (CMK). It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation can not be enabled for any asymmetric CMK.", @@ -887,7 +887,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet \"Rejects\" for VPCs.", @@ -908,7 +908,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.", @@ -929,7 +929,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Security Groups are a stateful packet filter that controls ingress and egress traffic within a VPC. It is recommended that a metric filter and alarm be established for detecting changes to Security Groups.", @@ -950,7 +950,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. NACLs are used as a stateless packet filter to control ingress and egress traffic for subnets within a VPC. It is recommended that a metric filter and alarm be established for changes made to NACLs.", @@ -971,7 +971,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Network gateways are required to send/receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.", @@ -992,7 +992,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Routing tables are used to route network traffic between subnets and to network gateways. It is recommended that a metric filter and alarm be established for changes to route tables.", @@ -1013,7 +1013,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is possible to have more than 1 VPC within an account, in addition it is also possible to create a peer connection between 2 VPCs enabling network traffic to route between VPCs. It is recommended that a metric filter and alarm be established for changes made to VPCs.", @@ -1034,7 +1034,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizations changes made in the master AWS Account.", @@ -1055,7 +1055,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Security Hub collects security data from across AWS accounts, services, and supported third-party partner products and helps you analyze your security trends and identify the highest priority security issues. When you enable Security Hub, it begins to consume, aggregate, organize, and prioritize findings from AWS services that you have enabled, such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie. You can also enable integrations with AWS partner security products.", @@ -1076,7 +1076,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for console logins that are not protected by multi-factor authentication (MFA).", @@ -1097,7 +1097,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for 'root' login attempts.", @@ -1118,7 +1118,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established changes made to Identity and Access Management (IAM) policies.", @@ -1139,7 +1139,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.", @@ -1160,7 +1160,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for failed console authentication attempts.", @@ -1181,7 +1181,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for customer created CMKs which have changed state to disabled or scheduled deletion.", @@ -1202,7 +1202,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes to S3 bucket policies.", @@ -1223,7 +1223,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.", @@ -1246,7 +1246,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1269,7 +1269,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1292,7 +1292,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1313,7 +1313,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If you don't specify a security group when you launch an instance, the instance is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic. The default VPC in every region should have its default security group updated to comply. Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation. **NOTE:** When implementing this recommendation, VPC flow logging is invaluable in determining the least privilege port access required by systems to work properly because it can log all packet acceptances and rejections occurring under the current security groups. This dramatically reduces the primary barrier to least privilege engineering - discovering the minimum ports required by systems in the environment. Even if the VPC flow logging recommendation in this benchmark is not adopted as a permanent security measure, it should be used during any period of discovery and engineering for least privileged security groups.", @@ -1334,7 +1334,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection.", diff --git a/prowler/compliance/aws/cis_2.0_aws.json b/prowler/compliance/aws/cis_2.0_aws.json index 1d12e296d5..b847e5e38e 100644 --- a/prowler/compliance/aws/cis_2.0_aws.json +++ b/prowler/compliance/aws/cis_2.0_aws.json @@ -12,7 +12,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.", @@ -33,7 +33,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.", @@ -54,7 +54,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS console defaults to no check boxes selected when creating a new IAM user. When cerating the IAM User credentials you have to determine what type of access they require. Programmatic access: The IAM user might need to make API calls, use the AWS CLI, or use the Tools for Windows PowerShell. In that case, create an access key (access key ID and a secret access key) for that user. AWS Management Console access: If the user needs to access the AWS Management Console, create a password for the user.", @@ -76,7 +76,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.", @@ -97,7 +97,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)", @@ -118,7 +118,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be regularly rotated.", @@ -139,7 +139,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM users are granted access to services, functions, and data through IAM policies. There are three ways to define policies for a user: 1) Edit the user policy directly, aka an inline, or user, policy; 2) attach a policy directly to a user; 3) add the user to an IAM group that has an attached policy. Only the third implementation is recommended.", @@ -161,7 +161,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered a standard security advice to grant _least privilege_ -that is, granting only the permissions required to perform a task. Determine what users need to do and then craft policies for them that let the users perform _only_ those tasks, instead of allowing full administrative privileges.", @@ -182,7 +182,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support.", @@ -203,7 +203,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. \"AWS Access\" means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.", @@ -224,7 +224,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use ACM or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.", @@ -245,7 +245,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.", @@ -266,7 +266,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable IAM Access analyzer for IAM policies about all resources in each region. IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. So the results allow you to determine if an unintended user is allowed, making it easier for administrators to monitor least privileges access. Access Analyzer analyzes only policies that are applied to resources in the same AWS Region.", @@ -287,7 +287,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.", @@ -308,7 +308,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "AWS CloudShell is a convenient way of running CLI commands against AWS services; a managed IAM policy ('AWSCloudShellFullAccess') provides full access to CloudShell, which allows file upload and download capability between a user's local system and the CloudShell environment. Within the CloudShell environment a user has sudo permissions, and can access the internet. So it is feasible to install file transfer software (for example) and move data from CloudShell to external internet servers.", @@ -329,7 +329,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established.", @@ -350,7 +350,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be removed.", @@ -371,7 +371,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device. **Note:** When virtual MFA is used for 'root' accounts, it is recommended that the device used is NOT a personal device, but rather a dedicated mobile device (tablet or phone) that is managed to be kept charged and secured independent of any individual personal devices. (\"non-personal virtual MFA\") This lessens the risks of losing access to the MFA due to device loss, device trade-in or if the individual owning the device is no longer employed at the company.", @@ -392,7 +392,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the 'root' user account be protected with a hardware MFA.", @@ -413,7 +413,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. That user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.", @@ -434,7 +434,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure password are at least a given length. It is recommended that the password policy require a minimum password length 14.", @@ -455,7 +455,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords.", @@ -476,7 +476,7 @@ ], "Attributes": [ { - "Section": "2. Storage", + "Section": "2 Storage", "SubSection": "2.1. Simple Storage Service (S3)", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -499,8 +499,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.", @@ -521,8 +521,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.", @@ -544,8 +544,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Amazon S3 provides `Block public access (bucket settings)` and `Block public access (account settings)` to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, `Block public access (bucket settings)` prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, `Block public access (account settings)` prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.", @@ -566,8 +566,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.2. Elastic Compute Cloud (EC2)", + "Section": "2 Storage", + "SubSection": "2.2 Elastic Compute Cloud (EC2)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service. While disabled by default, forcing encryption at EBS volume creation is supported.", @@ -589,8 +589,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.3. Relational Database Service (RDS)", + "Section": "2 Storage", + "SubSection": "2.3 Relational Database Service (RDS)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Amazon RDS encrypted DB instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles authentication of access and decryption of your data transparently with a minimal impact on performance.", @@ -611,8 +611,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.3. Relational Database Service (RDS)", + "Section": "2 Storage", + "SubSection": "2.3 Relational Database Service (RDS)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance window. So, RDS instances can get the new features, bug fixes, and security patches for their database engines.", @@ -633,8 +633,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.3. Relational Database Service (RDS)", + "Section": "2 Storage", + "SubSection": "2.3 Relational Database Service (RDS)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure and verify that RDS database instances provisioned in your AWS account do restrict unauthorized access in order to minimize security risks. To restrict access to any publicly accessible RDS database instance, you must disable the database Publicly Accessible flag and update the VPC security group associated with the instance.", @@ -655,7 +655,7 @@ ], "Attributes": [ { - "Section": "2. Storage", + "Section": "2 Storage", "SubSection": "2.4 Elastic File System (EFS)", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -677,7 +677,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).", @@ -698,7 +698,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.", @@ -719,7 +719,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.", @@ -740,7 +740,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.", @@ -761,7 +761,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "CloudTrail logs a record of every API call made in your AWS account. These logs file are stored in an S3 bucket. It is recommended that the bucket policy or access control list (ACL) applied to the S3 bucket that CloudTrail logs to prevent public access to the CloudTrail logs.", @@ -782,7 +782,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls made in a given AWS account. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail uses Amazon S3 for log file storage and delivery, so log files are stored durably. In addition to capturing CloudTrail logs within a specified S3 bucket for long term analysis, realtime analysis can be performed by configuring CloudTrail to send logs to CloudWatch Logs. For a trail that is enabled in all regions in an account, CloudTrail sends log files from all those regions to a CloudWatch Logs log group. It is recommended that CloudTrail logs be sent to CloudWatch Logs. Note: The intent of this recommendation is to ensure AWS account activity is being captured, monitored, and appropriately alarmed on. CloudWatch Logs is a native way to accomplish this using AWS services but does not preclude the use of an alternate solution.", @@ -803,7 +803,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration item (AWS resource), relationships between configuration items (AWS resources), any configuration changes between resources. It is recommended AWS Config be enabled in all regions.", @@ -824,7 +824,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.", @@ -845,7 +845,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.", @@ -866,7 +866,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS which is tied to the key ID of the Customer Created customer master key (CMK). It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation can not be enabled for any asymmetric CMK.", @@ -887,7 +887,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet \"Rejects\" for VPCs.", @@ -908,7 +908,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.", @@ -929,7 +929,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Security Groups are a stateful packet filter that controls ingress and egress traffic within a VPC. It is recommended that a metric filter and alarm be established for detecting changes to Security Groups.", @@ -950,7 +950,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. NACLs are used as a stateless packet filter to control ingress and egress traffic for subnets within a VPC. It is recommended that a metric filter and alarm be established for changes made to NACLs.", @@ -971,7 +971,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Network gateways are required to send/receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.", @@ -992,7 +992,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Routing tables are used to route network traffic between subnets and to network gateways. It is recommended that a metric filter and alarm be established for changes to route tables.", @@ -1013,7 +1013,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is possible to have more than 1 VPC within an account, in addition it is also possible to create a peer connection between 2 VPCs enabling network traffic to route between VPCs. It is recommended that a metric filter and alarm be established for changes made to VPCs.", @@ -1034,7 +1034,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizations changes made in the master AWS Account.", @@ -1055,7 +1055,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Security Hub collects security data from across AWS accounts, services, and supported third-party partner products and helps you analyze your security trends and identify the highest priority security issues. When you enable Security Hub, it begins to consume, aggregate, organize, and prioritize findings from AWS services that you have enabled, such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie. You can also enable integrations with AWS partner security products.", @@ -1076,7 +1076,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for console logins that are not protected by multi-factor authentication (MFA).", @@ -1097,7 +1097,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for 'root' login attempts.", @@ -1118,7 +1118,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established changes made to Identity and Access Management (IAM) policies.", @@ -1139,7 +1139,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.", @@ -1160,7 +1160,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for failed console authentication attempts.", @@ -1181,7 +1181,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for customer created CMKs which have changed state to disabled or scheduled deletion.", @@ -1202,7 +1202,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes to S3 bucket policies.", @@ -1223,7 +1223,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.", @@ -1246,7 +1246,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1269,7 +1269,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1292,7 +1292,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1313,7 +1313,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If you don't specify a security group when you launch an instance, the instance is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic. The default VPC in every region should have its default security group updated to comply. Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation. **NOTE:** When implementing this recommendation, VPC flow logging is invaluable in determining the least privilege port access required by systems to work properly because it can log all packet acceptances and rejections occurring under the current security groups. This dramatically reduces the primary barrier to least privilege engineering - discovering the minimum ports required by systems in the environment. Even if the VPC flow logging recommendation in this benchmark is not adopted as a permanent security measure, it should be used during any period of discovery and engineering for least privileged security groups.", @@ -1334,7 +1334,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection.", @@ -1356,7 +1356,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "When enabling the Metadata Service on AWS EC2 instances, users have the option of using either Instance Metadata Service Version 1 (IMDSv1; a request/response method) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method).", diff --git a/prowler/compliance/aws/cis_3.0_aws.json b/prowler/compliance/aws/cis_3.0_aws.json index 9b45e6c7b8..9b9ff78ded 100644 --- a/prowler/compliance/aws/cis_3.0_aws.json +++ b/prowler/compliance/aws/cis_3.0_aws.json @@ -12,7 +12,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.", @@ -33,7 +33,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.", @@ -54,7 +54,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS console defaults to no check boxes selected when creating a new IAM user. When cerating the IAM User credentials you have to determine what type of access they require. Programmatic access: The IAM user might need to make API calls, use the AWS CLI, or use the Tools for Windows PowerShell. In that case, create an access key (access key ID and a secret access key) for that user. AWS Management Console access: If the user needs to access the AWS Management Console, create a password for the user.", @@ -76,7 +76,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.", @@ -97,7 +97,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)", @@ -118,7 +118,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be regularly rotated.", @@ -139,7 +139,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM users are granted access to services, functions, and data through IAM policies. There are three ways to define policies for a user: 1) Edit the user policy directly, aka an inline, or user, policy; 2) attach a policy directly to a user; 3) add the user to an IAM group that has an attached policy. Only the third implementation is recommended.", @@ -161,7 +161,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered a standard security advice to grant _least privilege_ -that is, granting only the permissions required to perform a task. Determine what users need to do and then craft policies for them that let the users perform _only_ those tasks, instead of allowing full administrative privileges.", @@ -182,7 +182,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support.", @@ -203,7 +203,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. \"AWS Access\" means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.", @@ -224,7 +224,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use ACM or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.", @@ -245,7 +245,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.", @@ -266,7 +266,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable IAM Access analyzer for IAM policies about all resources in each region. IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. So the results allow you to determine if an unintended user is allowed, making it easier for administrators to monitor least privileges access. Access Analyzer analyzes only policies that are applied to resources in the same AWS Region.", @@ -287,7 +287,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.", @@ -306,7 +306,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "AWS CloudShell is a convenient way of running CLI commands against AWS services; a managed IAM policy ('AWSCloudShellFullAccess') provides full access to CloudShell, which allows file upload and download capability between a user's local system and the CloudShell environment. Within the CloudShell environment a user has sudo permissions, and can access the internet. So it is feasible to install file transfer software (for example) and move data from CloudShell to external internet servers.", @@ -327,7 +327,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established.", @@ -348,7 +348,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be removed.", @@ -369,7 +369,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device. **Note:** When virtual MFA is used for 'root' accounts, it is recommended that the device used is NOT a personal device, but rather a dedicated mobile device (tablet or phone) that is managed to be kept charged and secured independent of any individual personal devices. (\"non-personal virtual MFA\") This lessens the risks of losing access to the MFA due to device loss, device trade-in or if the individual owning the device is no longer employed at the company.", @@ -390,7 +390,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the 'root' user account be protected with a hardware MFA.", @@ -411,7 +411,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. That user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.", @@ -432,7 +432,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure password are at least a given length. It is recommended that the password policy require a minimum password length 14.", @@ -453,7 +453,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords.", @@ -474,8 +474,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "At the Amazon S3 bucket level, you can configure permissions through a bucket policy making the objects accessible only through HTTPS.", @@ -496,8 +496,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.", @@ -518,8 +518,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.", @@ -541,8 +541,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Amazon S3 provides `Block public access (bucket settings)` and `Block public access (account settings)` to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, `Block public access (bucket settings)` prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, `Block public access (account settings)` prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.", @@ -563,8 +563,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.2. Elastic Compute Cloud (EC2)", + "Section": "2 Storage", + "SubSection": "2.2 Elastic Compute Cloud (EC2)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service. While disabled by default, forcing encryption at EBS volume creation is supported.", @@ -585,8 +585,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.3. Relational Database Service (RDS)", + "Section": "2 Storage", + "SubSection": "2.3 Relational Database Service (RDS)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Amazon RDS encrypted DB instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles authentication of access and decryption of your data transparently with a minimal impact on performance.", @@ -607,8 +607,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.3. Relational Database Service (RDS)", + "Section": "2 Storage", + "SubSection": "2.3 Relational Database Service (RDS)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance window. So, RDS instances can get the new features, bug fixes, and security patches for their database engines.", @@ -629,8 +629,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.3. Relational Database Service (RDS)", + "Section": "2 Storage", + "SubSection": "2.3 Relational Database Service (RDS)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure and verify that RDS database instances provisioned in your AWS account do restrict unauthorized access in order to minimize security risks. To restrict access to anypublicly accessible RDS database instance, you must disable the database PubliclyAccessible flag and update the VPC security group associated with the instance", @@ -651,7 +651,7 @@ ], "Attributes": [ { - "Section": "2. Storage", + "Section": "2 Storage", "SubSection": "2.4 Elastic File System (EFS)", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -673,7 +673,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).", @@ -694,7 +694,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.", @@ -715,7 +715,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.", @@ -736,7 +736,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.", @@ -757,7 +757,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration item (AWS resource), relationships between configuration items (AWS resources), any configuration changes between resources. It is recommended AWS Config be enabled in all regions.", @@ -778,7 +778,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.", @@ -799,7 +799,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.", @@ -820,7 +820,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS which is tied to the key ID of the Customer Created customer master key (CMK). It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation can not be enabled for any asymmetric CMK.", @@ -841,7 +841,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet \"Rejects\" for VPCs.", @@ -862,7 +862,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.", @@ -883,7 +883,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Security Groups are a stateful packet filter that controls ingress and egress traffic within a VPC. It is recommended that a metric filter and alarm be established for detecting changes to Security Groups.", @@ -904,7 +904,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. NACLs are used as a stateless packet filter to control ingress and egress traffic for subnets within a VPC. It is recommended that a metric filter and alarm be established for changes made to NACLs.", @@ -925,7 +925,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Network gateways are required to send/receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.", @@ -946,7 +946,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Routing tables are used to route network traffic between subnets and to network gateways. It is recommended that a metric filter and alarm be established for changes to route tables.", @@ -967,7 +967,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is possible to have more than 1 VPC within an account, in addition it is also possible to create a peer connection between 2 VPCs enabling network traffic to route between VPCs. It is recommended that a metric filter and alarm be established for changes made to VPCs.", @@ -988,7 +988,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizations changes made in the master AWS Account.", @@ -1009,7 +1009,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Security Hub collects security data from across AWS accounts, services, and supported third-party partner products and helps you analyze your security trends and identify the highest priority security issues. When you enable Security Hub, it begins to consume, aggregate, organize, and prioritize findings from AWS services that you have enabled, such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie. You can also enable integrations with AWS partner security products.", @@ -1030,7 +1030,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for console logins that are not protected by multi-factor authentication (MFA).", @@ -1051,7 +1051,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for 'root' login attempts.", @@ -1072,7 +1072,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established changes made to Identity and Access Management (IAM) policies.", @@ -1093,7 +1093,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.", @@ -1114,7 +1114,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for failed console authentication attempts.", @@ -1135,7 +1135,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for customer created CMKs which have changed state to disabled or scheduled deletion.", @@ -1156,7 +1156,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes to S3 bucket policies.", @@ -1177,7 +1177,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.", @@ -1200,7 +1200,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1223,7 +1223,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1246,7 +1246,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1267,7 +1267,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If you don't specify a security group when you launch an instance, the instance is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic. The default VPC in every region should have its default security group updated to comply. Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation. **NOTE:** When implementing this recommendation, VPC flow logging is invaluable in determining the least privilege port access required by systems to work properly because it can log all packet acceptances and rejections occurring under the current security groups. This dramatically reduces the primary barrier to least privilege engineering - discovering the minimum ports required by systems in the environment. Even if the VPC flow logging recommendation in this benchmark is not adopted as a permanent security measure, it should be used during any period of discovery and engineering for least privileged security groups.", @@ -1288,7 +1288,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection.", @@ -1309,7 +1309,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "When enabling the Metadata Service on AWS EC2 instances, users have the option of using either Instance Metadata Service Version 1 (IMDSv1; a request/response method) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method).", diff --git a/prowler/compliance/aws/cis_4.0_aws.json b/prowler/compliance/aws/cis_4.0_aws.json index d026a21962..cd8edb322a 100644 --- a/prowler/compliance/aws/cis_4.0_aws.json +++ b/prowler/compliance/aws/cis_4.0_aws.json @@ -13,7 +13,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization.An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of the Acceptable Use Policy or indicative of a likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.", @@ -36,7 +35,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.", @@ -59,7 +57,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established.", @@ -82,7 +79,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be deleted.", @@ -105,7 +101,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device.**Note:** When virtual MFA is used for 'root' accounts, it is recommended that the device used is NOT a personal device, but rather a dedicated mobile device (tablet or phone) that is kept charged and secured, independent of any individual personal devices (non-personal virtual MFA). This lessens the risks of losing access to the MFA due to device loss, device trade-in, or if the individual owning the device is no longer employed at the company.", @@ -128,7 +123,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the 'root' user account be protected with a hardware MFA.", @@ -151,7 +145,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. That user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.", @@ -174,7 +167,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure passwords are at least a given length. It is recommended that the password policy require a minimum password length 14.", @@ -197,7 +189,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords.", @@ -220,7 +211,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.", @@ -243,7 +233,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "AWS console defaults to no check boxes selected when creating a new IAM user. When creating the IAM User credentials you have to determine what type of access they require. Programmatic access: The IAM user might need to make API calls, use the AWS CLI, or use the Tools for Windows PowerShell. In that case, create an access key (access key ID and a secret access key) for that user. AWS Management Console access: If the user needs to access the AWS Management Console, create a password for the user.", @@ -267,7 +256,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused for 45 days or more be deactivated or removed.", @@ -290,7 +278,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)", @@ -313,7 +300,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be rotated regularly.", @@ -336,7 +322,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM users are granted access to services, functions, and data through IAM policies. There are four ways to define policies for a user: 1) Edit the user policy directly, also known as an inline or user policy; 2) attach a policy directly to a user; 3) add the user to an IAM group that has an attached policy; 4) add the user to an IAM group that has an inline policy.Only the third implementation is recommended.", @@ -360,7 +345,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered standard security advice to grant least privilege—that is, granting only the permissions required to perform a task. Determine what users need to do, and then craft policies for them that allow the users to perform only those tasks, instead of granting full administrative privileges.", @@ -383,7 +367,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role, with the appropriate policy assigned, to allow authorized users to manage incidents with AWS Support.", @@ -406,7 +389,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. AWS Access means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.", @@ -429,7 +411,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use AWS Certificate Manager (ACM) or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.", @@ -452,7 +433,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable the IAM Access Analyzer for IAM policies regarding all resources in each active AWS region.IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. The results allow you to determine whether an unintended user is permitted, making it easier for administrators to monitor least privilege access. Access Analyzer analyzes only the policies that are applied to resources in the same AWS Region.", @@ -475,7 +455,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.", @@ -498,7 +477,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "AWS CloudShell is a convenient way of running CLI commands against AWS services; a managed IAM policy ('AWSCloudShellFullAccess') provides full access to CloudShell, which allows file upload and download capability between a user's local system and the CloudShell environment. Within the CloudShell environment, a user has sudo permissions and can access the internet. Therefore, it is feasible to install file transfer software, for example, and move data from CloudShell to external internet servers.", @@ -730,7 +708,6 @@ "Attributes": [ { "Section": "3 Logging", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).", @@ -753,7 +730,6 @@ "Attributes": [ { "Section": "3 Logging", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or remained unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled for all CloudTrails.", @@ -776,7 +752,6 @@ "Attributes": [ { "Section": "3 Logging", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration items (AWS resources), relationships between configuration items (AWS resources), and any configuration changes between resources. It is recommended that AWS Config be enabled in all regions.", @@ -799,7 +774,6 @@ "Attributes": [ { "Section": "3 Logging", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Server access logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that server access logging be enabled on the CloudTrail S3 bucket.", @@ -822,7 +796,6 @@ "Attributes": [ { "Section": "3 Logging", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer-created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.", @@ -845,7 +818,6 @@ "Attributes": [ { "Section": "3 Logging", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS Key Management Service (KMS) allows customers to rotate the backing key, which is key material stored within the KMS that is tied to the key ID of the customer-created customer master key (CMK). The backing key is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can occur transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation cannot be enabled for any asymmetric CMK.", @@ -868,7 +840,6 @@ "Attributes": [ { "Section": "3 Logging", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet Rejects for VPCs.", @@ -891,7 +862,6 @@ "Attributes": [ { "Section": "3 Logging", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "S3 object-level API operations, such as GetObject, DeleteObject, and PutObject, are referred to as data events. By default, CloudTrail trails do not log data events, so it is recommended to enable object-level logging for S3 buckets.", @@ -914,7 +884,6 @@ "Attributes": [ { "Section": "3 Logging", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "S3 object-level API operations, such as GetObject, DeleteObject, and PutObject, are referred to as data events. By default, CloudTrail trails do not log data events, so it is recommended to enable object-level logging for S3 buckets.", @@ -937,7 +906,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.", @@ -960,7 +928,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for console logins that are not protected by multi-factor authentication (MFA).", @@ -983,7 +950,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for 'root' login attempts to detect unauthorized use or attempts to use the root account.", @@ -1006,7 +972,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms.It is recommended that a metric filter and alarm be established for changes made to Identity and Access Management (IAM) policies.", @@ -1029,7 +994,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be used to detect changes to CloudTrail's configurations.", @@ -1052,7 +1016,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for failed console authentication attempts.", @@ -1075,7 +1038,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for customer-created CMKs that have changed state to disabled or are scheduled for deletion.", @@ -1098,7 +1060,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes to S3 bucket policies.", @@ -1121,7 +1082,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to AWS Config's configurations.", @@ -1144,7 +1104,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. Security groups are stateful packet filters that control ingress and egress traffic within a VPC.It is recommended that a metric filter and alarm be established to detect changes to security groups.", @@ -1167,7 +1126,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. NACLs are used as a stateless packet filter to control ingress and egress traffic for subnets within a VPC. It is recommended that a metric filter and alarm be established for any changes made to NACLs.", @@ -1190,7 +1148,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. Network gateways are required to send and receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.", @@ -1213,7 +1170,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. Routing tables are used to route network traffic between subnets and to network gateways.It is recommended that a metric filter and alarm be established for changes to route tables.", @@ -1236,7 +1192,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is possible to have more than one VPC within an account; additionally, it is also possible to create a peer connection between two VPCs, enabling network traffic to route between them.It is recommended that a metric filter and alarm be established for changes made to VPCs.", @@ -1259,7 +1214,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes made to AWS Organizations in the master AWS account.", @@ -1282,7 +1236,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Security Hub collects security data from various AWS accounts, services, and supported third-party partner products, helping you analyze your security trends and identify the highest-priority security issues. When you enable Security Hub, it begins to consume, aggregate, organize, and prioritize findings from the AWS services that you have enabled, such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie. You can also enable integrations with AWS partner security products.", @@ -1307,7 +1260,6 @@ "Attributes": [ { "Section": "5 Networking", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The Network Access Control List (NACL) function provides stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH on port `22` and RDP on port `3389`, using either the TCP (6), UDP (17), or ALL (-1) protocols.", @@ -1332,7 +1284,6 @@ "Attributes": [ { "Section": "5 Networking", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH on port `22` and RDP on port `3389`, using either the TCP (6), UDP (17), or ALL (-1) protocols.", @@ -1357,7 +1308,6 @@ "Attributes": [ { "Section": "5 Networking", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH on port `22` and RDP on port `3389`.", @@ -1380,7 +1330,6 @@ "Attributes": [ { "Section": "5 Networking", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If a security group is not specified when an instance is launched, it is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic, both inbound and outbound.The default VPC in every region should have its default security group updated to comply with the following: - No inbound rules. - No outbound rules.Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation.**Note:** When implementing this recommendation, VPC flow logging is invaluable in determining the least privilege port access required by systems to work properly, as it can log all packet acceptances and rejections occurring under the current security groups. This dramatically reduces the primary barrier to least privilege engineering by discovering the minimum ports required by systems in the environment. Even if the VPC flow logging recommendation in this benchmark is not adopted as a permanent security measure, it should be used during any period of discovery and engineering for least privileged security groups.", @@ -1403,7 +1352,6 @@ "Attributes": [ { "Section": "5 Networking", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Once a VPC peering connection is established, routing tables must be updated to enable any connections between the peered VPCs. These routes can be as specific as desired, even allowing for the peering of a VPC to only a single host on the other side of the connection.", @@ -1426,7 +1374,6 @@ "Attributes": [ { "Section": "5 Networking", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "When enabling the Metadata Service on AWS EC2 instances, users have the option of using either Instance Metadata Service Version 1 (IMDSv1; a request/response method) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method).", diff --git a/prowler/compliance/aws/cis_5.0_aws.json b/prowler/compliance/aws/cis_5.0_aws.json new file mode 100644 index 0000000000..b95feddd27 --- /dev/null +++ b/prowler/compliance/aws/cis_5.0_aws.json @@ -0,0 +1,1415 @@ +{ + "Framework": "CIS", + "Version": "5.0", + "Provider": "AWS", + "Description": "The CIS Amazon Web Services Foundations Benchmark provides prescriptive guidance for configuring security options for a subset of Amazon Web Services with an emphasis on foundational, testable, and architecture agnostic settings.", + "Requirements": [ + { + "Id": "1.1", + "Description": "Maintain current contact details", + "Checks": [ + "account_maintain_current_contact_details" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Manual", + "Description": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of the Acceptable Use Policy or indicative of a likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.", + "RationaleStatement": "If an AWS account is observed to be behaving in a prohibited or suspicious manner, AWS will attempt to contact the account owner by email and phone using the contact details listed. If this is unsuccessful and the account behavior needs urgent mitigation, proactive measures may be taken, including throttling of traffic between the account exhibiting suspicious behavior and the AWS API endpoints and the Internet. This will result in impaired service to and from the account in question, so it is in both the customers' and AWS's best interests that prompt contact can be established. This is best achieved by setting AWS account contact details to point to resources which have multiple individuals as recipients, such as email aliases and PABX hunt groups.", + "ImpactStatement": "", + "RemediationProcedure": "This activity can only be performed via the AWS Console, with a user who has permission to read and write Billing information (aws-portal:\\*Billing). 1. Sign in to the AWS Management Console and open the `Billing and Cost Management` console at https://console.aws.amazon.com/billing/home#/. 2. On the navigation bar, choose your account name, and then choose `Account`. 3. On the `Account Settings` page, next to `Account Settings`, choose `Edit`. 4. Next to the field that you need to update, choose `Edit`. 5. After you have entered your changes, choose `Save changes`. 6. After you have made your changes, choose `Done`. 7. To edit your contact information, under `Contact Information`, choose `Edit`. 8. For the fields that you want to change, type your updated information, and then choose `Update`.", + "AuditProcedure": "This activity can only be performed via the AWS Console, with a user who has permission to read and write Billing information (aws-portal:\\*Billing). 1. Sign in to the AWS Management Console and open the `Billing and Cost Management` console at https://console.aws.amazon.com/billing/home#/. 2. On the navigation bar, choose your account name, and then choose `Account`. 3. On the `Account Settings` page, review and verify the current details. 4. Under `Contact Information`, review and verify the current details.", + "AdditionalInformation": "", + "References": "https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/manage-account-payment.html#contact-info", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.2", + "Description": "Ensure security contact information is registered", + "Checks": [ + "account_security_contact_information_is_registered" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Manual", + "Description": "AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.", + "RationaleStatement": "Specifying security-specific contact information will help ensure that security advisories sent by AWS reach the team in your organization that is best equipped to respond to them.", + "ImpactStatement": "", + "RemediationProcedure": "Perform the following to establish security contact information: **From Console:** 1. Click on your account name at the top right corner of the console. 2. From the drop-down menu Click `My Account` 3. Scroll down to the `Alternate Contacts` section 4. Enter contact information in the `Security` section **From Command Line:** Run the following command with the following input parameters: --email-address, --name, and --phone-number. ``` aws account put-alternate-contact --alternate-contact-type SECURITY ``` **Note:** Consider specifying an internal email distribution list to ensure emails are regularly monitored by more than one individual.", + "AuditProcedure": "Perform the following to determine if security contact information is present: **From Console:** 1. Click on your account name at the top right corner of the console 2. From the drop-down menu Click `My Account` 3. Scroll down to the `Alternate Contacts` section 4. Ensure contact information is specified in the `Security` section **From Command Line:** 1. Run the following command: ``` aws account get-alternate-contact --alternate-contact-type SECURITY ``` 2. Ensure proper contact information is specified for the `Security` contact.", + "AdditionalInformation": "", + "References": "", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.3", + "Description": "Ensure no 'root' user account access key exists", + "Checks": [ + "iam_no_root_access_key" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be deleted.", + "RationaleStatement": "Deleting access keys associated with the 'root' user account limits vectors by which the account can be compromised. Additionally, deleting the 'root' access keys encourages the creation and use of role based accounts that are least privileged.", + "ImpactStatement": "", + "RemediationProcedure": "Perform the following to delete active 'root' user access keys. **From Console:** 1. Sign in to the AWS Management Console as 'root' and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 2. Click on `` at the top right and select `My Security Credentials` from the drop down list. 3. On the pop out screen Click on `Continue to Security Credentials`. 4. Click on `Access Keys` (Access Key ID and Secret Access Key). 5. If there are active keys, under `Status`, click `Delete` (Note: Deleted keys cannot be recovered). Note: While a key can be made inactive, this inactive key will still show up in the CLI command from the audit procedure, and may lead to the root user being falsely flagged as being non-compliant.", + "AuditProcedure": "Perform the following to determine if the 'root' user account has access keys: **From Console:** 1. Login to the AWS Management Console. 2. Click `Services`. 3. Click `IAM`. 4. Click on `Credential Report`. 5. This will download a `.csv` file which contains credential usage for all IAM users within an AWS Account - open this file. 6. For the `` user, ensure the `access_key_1_active` and `access_key_2_active` fields are set to `FALSE`. **From Command Line:** Run the following command: ``` aws iam get-account-summary | grep AccountAccessKeysPresent ``` If no 'root' access keys exist the output will show `AccountAccessKeysPresent: 0,`. If the output shows a 1, then 'root' keys exist and should be deleted.", + "AdditionalInformation": "- IAM User account root for us-gov cloud regions is not enabled by default. However, on request to AWS support enables 'root' access only through access-keys (CLI, API methods) for us-gov cloud region. - Implement regular checks and alerts for any creation of new root access keys to promptly address any unauthorized or accidental creation.", + "References": "http://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.html:http://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html:http://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountSummary.html:https://aws.amazon.com/blogs/security/an-easier-way-to-determine-the-presence-of-aws-account-access-keys/", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.4", + "Description": "Ensure MFA is enabled for the 'root' user account", + "Checks": [ + "iam_root_mfa_enabled" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device. **Note:** When virtual MFA is used for 'root' accounts, it is recommended that the device used is NOT a personal device, but rather a dedicated mobile device (tablet or phone) that is kept charged and secured, independent of any individual personal devices (non-personal virtual MFA). This lessens the risks of losing access to the MFA due to device loss, device trade-in, or if the individual owning the device is no longer employed at the company. Where an AWS Organization is using centralized root access, root credentials can be removed from member accounts. In that case it is neither possible nor necessary to configure root MFA in the member account.", + "RationaleStatement": "Enabling MFA provides increased security for console access as it requires the authenticating principal to possess a device that emits a time-sensitive key and have knowledge of a credential.", + "ImpactStatement": "", + "RemediationProcedure": "**Note:** To manage MFA devices for the 'root' AWS account, you must use your 'root' account credentials to sign in to AWS. You cannot manage MFA devices for the 'root' account using other credentials. Perform the following to establish MFA for the 'root' user account: 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 2. Choose `Dashboard` , and under `Security Status` , expand `Activate MFA` on your root account. 3. Choose `Activate MFA` 4. In the wizard, choose `A virtual MFA` device and then choose `Next Step` . 5. IAM generates and displays configuration information for the virtual MFA device, including a QR code graphic. The graphic is a representation of the 'secret configuration key' that is available for manual entry on devices that do not support QR codes. 6. Open your virtual MFA application. (For a list of apps that you can use for hosting virtual MFA devices, see [Virtual MFA Applications](http://aws.amazon.com/iam/details/mfa/#Virtual_MFA_Applications).) If the virtual MFA application supports multiple accounts (multiple virtual MFA devices), choose the option to create a new account (a new virtual MFA device). 7. Determine whether the MFA app supports QR codes, and then do one of the following: - Use the app to scan the QR code. For example, you might choose the camera icon or choose an option similar to Scan code, and then use the device's camera to scan the code. - In the Manage MFA Device wizard, choose Show secret key for manual configuration, and then type the secret configuration key into your MFA application. When you are finished, the virtual MFA device starts generating one-time passwords. In the Manage MFA Device wizard, in the Authentication Code 1 box, type the one-time password that currently appears in the virtual MFA device. Wait up to 30 seconds for the device to generate a new one-time password. Then type the second one-time password into the Authentication Code 2 box. Choose Assign Virtual MFA.", + "AuditProcedure": "Perform the following to determine if the 'root' user account is enabled and has MFA setup: **From Console:** 1. Login to the AWS Management Console 2. Click `Services` 3. Click `IAM` 4. Click on `Credential Report` 5. This will download a `.csv` file which contains credential usage for all IAM users within an AWS Account - open this file 6. For the `` user, ensure the `mfa_active` field is set to `TRUE` or the `password_enabled` field is set to `FALSE` **From Command Line:** 1. Run the following command: ``` aws iam get-account-summary | grep AccountMFAEnabled aws iam get-account-summary | grep AccountPasswordPresent ``` 2. Ensure the AccountMFAEnabled property is set to 1 or the AccountPasswordPresent property is set to 0", + "AdditionalInformation": "IAM User account root for us-gov cloud regions does not have console access. This recommendation is not applicable for us-gov cloud regions.", + "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#id_root-user_manage_mfa:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html#enable-virt-mfa-for-root:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-enable-root-access.html", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.5", + "Description": "Ensure hardware MFA is enabled for the 'root' user account", + "Checks": [ + "iam_root_hardware_mfa_enabled" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 2", + "AssessmentStatus": "Manual", + "Description": "The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the 'root' user account be protected with a hardware MFA. Where an AWS Organization is using centralized root access, root credentials can be removed from member accounts. In that case it is neither possible nor necessary to configure root MFA in the member account.", + "RationaleStatement": "A hardware MFA has a smaller attack surface than a virtual MFA. For example, a hardware MFA does not suffer the attack surface introduced by the mobile smartphone on which a virtual MFA resides. **Note**: Using hardware MFA for numerous AWS accounts may create a logistical device management issue. If this is the case, consider implementing this Level 2 recommendation selectively for the highest security AWS accounts, while applying the Level 1 recommendation to the remaining accounts.", + "ImpactStatement": "", + "RemediationProcedure": "**Note:** To manage MFA devices for the AWS 'root' user account, you must use your 'root' account credentials to sign in to AWS. You cannot manage MFA devices for the 'root' account using other credentials. Perform the following to establish a hardware MFA for the 'root' user account: 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 2. Choose `Dashboard`, and under `Security Status`, expand `Activate MFA` on your root account. 3. Choose `Activate MFA`. 4. In the wizard, choose `A hardware MFA` device and then choose `Next Step`. 5. In the `Serial Number` box, enter the serial number that is found on the back of the MFA device. 6. In the `Authentication Code 1` box, enter the six-digit number displayed by the MFA device. You might need to press the button on the front of the device to display the number. 7. Wait 30 seconds while the device refreshes the code, and then enter the next six-digit number into the `Authentication Code 2` box. You might need to press the button on the front of the device again to display the second number. 8. Choose `Next Step`. The MFA device is now associated with the AWS account. The next time you use your AWS account credentials to sign in, you must type a code from the hardware MFA device. Remediation for this recommendation is not available through AWS CLI.", + "AuditProcedure": "Perform the following to determine if the 'root' user account has a hardware MFA setup: 1. Run the following command to determine if the 'root' account has MFA setup: ``` aws iam get-account-summary | grep AccountMFAEnabled aws iam get-account-summary | grep AccountPasswordPresent ``` The `AccountMFAEnabled` property is set to `1` will ensure that the 'root' user account has MFA (Virtual or Hardware) Enabled. `AccountPasswordPresent` set to `0` indicates that the `root` console credential has been removed. If `AccountMFAEnabled` property is set to `0` and `AccountPasswordPresent` is set to `1` the account is not compliant with this recommendation. 2. If `AccountMFAEnabled` property is set to `1`, determine 'root' account has Hardware MFA enabled. Run the following command to list all virtual MFA devices: ``` aws iam list-virtual-mfa-devices ``` If the output contains one MFA with the following Serial Number, it means the MFA is virtual, not hardware and the account is not compliant with this recommendation: `SerialNumber: arn:aws:iam::__:mfa/root-account-mfa-device`", + "AdditionalInformation": "IAM User account 'root' for us-gov cloud regions does not have console access. This control is not applicable for us-gov cloud regions.", + "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_physical.html#enable-hw-mfa-for-root:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-enable-root-access.html", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.6", + "Description": "Eliminate use of the 'root' user for administrative and daily tasks", + "Checks": [ + "iam_avoid_root_usage" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Manual", + "Description": "With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. That user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.", + "RationaleStatement": "The 'root user' has unrestricted access to and control over all account resources. Use of it is inconsistent with the principles of least privilege and separation of duties, and can lead to unnecessary harm due to error or account compromise.", + "ImpactStatement": "", + "RemediationProcedure": "If you find that the 'root' user account is being used for daily activities, including administrative tasks that do not require the 'root' user: 1. Change the 'root' user password. 2. Deactivate or delete any access keys associated with the 'root' user. Remember, anyone who has 'root' user credentials for your AWS account has unrestricted access to and control of all the resources in your account, including billing information.", + "AuditProcedure": "**From Console:** 1. Login to the AWS Management Console at `https://console.aws.amazon.com/iam/`. 2. In the left pane, click `Credential Report`. 3. Click on `Download Report`. 4. Open or Save the file locally. 5. Locate the `` under the user column. 6. Review `password_last_used, access_key_1_last_used_date, access_key_2_last_used_date` to determine when the 'root user' was last used. **From Command Line:** Run the following CLI commands to provide a credential report for determining the last time the 'root user' was used: ``` aws iam generate-credential-report ``` ``` aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,5,11,16 | grep -B1 '' ``` Review `password_last_used`, `access_key_1_last_used_date`, `access_key_2_last_used_date` to determine when the _root user_ was last used. **Note:** There are a few conditions under which the use of the 'root' user account is required. Please see the reference links for all of the tasks that require use of the 'root' user.", + "AdditionalInformation": "The 'root' user for us-gov cloud regions is not enabled by default. However, on request to AWS support, they can enable the 'root' user and grant access only through access-keys (CLI, API methods) for us-gov cloud region. If the 'root' user for us-gov cloud regions is enabled, this recommendation is applicable. Monitoring usage of the 'root' user can be accomplished by implementing recommendation 3.3 Ensure a log metric filter and alarm exist for usage of the 'root' user.", + "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html:https://docs.aws.amazon.com/general/latest/gr/aws_tasks-that-require-root.html", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.7", + "Description": "Ensure IAM password policy requires minimum length of 14 or greater", + "Checks": [ + "iam_password_policy_minimum_length_14" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure passwords are at least a given length. It is recommended that the password policy require a minimum password length 14.", + "RationaleStatement": "Setting a password complexity policy increases account resiliency against brute force login attempts.", + "ImpactStatement": "Enforcing a minimum password length of 14 characters enhances security by making passwords more resistant to brute force attacks. However, it may require users to create longer and potentially more complex passwords, which could impact user convenience.", + "RemediationProcedure": "Perform the following to set the password policy as prescribed: **From Console:** 1. Login to AWS Console (with appropriate permissions to View Identity Access Management Account Settings) 2. Go to IAM Service on the AWS Console 3. Click on Account Settings on the Left Pane 4. Set Minimum password length to `14` or greater. 5. Click Apply password policy **From Command Line:** ``` aws iam update-account-password-policy --minimum-password-length 14 ``` Note: All commands starting with aws iam update-account-password-policy can be combined into a single command.", + "AuditProcedure": "Perform the following to ensure the password policy is configured as prescribed: **From Console:** 1. Login to AWS Console (with appropriate permissions to View Identity Access Management Account Settings) 2. Go to IAM Service on the AWS Console 3. Click on Account Settings on the Left Pane 4. Ensure Minimum password length is set to 14 or greater. **From Command Line:** ``` aws iam get-account-password-policy ``` Ensure the output of the above command includes MinimumPasswordLength: 14 (or higher)", + "AdditionalInformation": "Ensure the password policy also includes requirements for password complexity, such as the inclusion of uppercase letters, lowercase letters, numbers, and special characters: ``` aws iam update-account-password-policy --require-uppercase-characters --require-lowercase-characters --require-numbers --require-symbols ```", + "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#configure-strong-password-policy", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.8", + "Description": "Ensure IAM password policy prevents password reuse", + "Checks": [ + "iam_password_policy_reuse_24" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords.", + "RationaleStatement": "Preventing password reuse increases account resiliency against brute force login attempts.", + "ImpactStatement": "", + "RemediationProcedure": "Perform the following to set the password policy as prescribed: **From Console:** 1. Login to AWS Console (with appropriate permissions to View Identity Access Management Account Settings) 2. Go to IAM Service on the AWS Console 3. Click on Account Settings on the Left Pane 4. Check Prevent password reuse 5. Set Number of passwords to remember is set to `24` **From Command Line:** ``` aws iam update-account-password-policy --password-reuse-prevention 24 ``` Note: All commands starting with aws iam update-account-password-policy can be combined into a single command.", + "AuditProcedure": "Perform the following to ensure the password policy is configured as prescribed: **From Console:** 1. Login to AWS Console (with appropriate permissions to View Identity Access Management Account Settings) 2. Go to IAM Service on the AWS Console 3. Click on Account Settings on the Left Pane 4. Ensure Prevent password reuse is checked 5. Ensure Number of passwords to remember is set to 24 **From Command Line:** ``` aws iam get-account-password-policy ``` Ensure the output of the above command includes PasswordReusePrevention: 24", + "AdditionalInformation": "", + "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#configure-strong-password-policy", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.9", + "Description": "Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password", + "Checks": [ + "iam_user_mfa_enabled_console_access" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.", + "RationaleStatement": "Enabling MFA provides increased security for console access as it requires the authenticating principal to possess a device that displays a time-sensitive key and have knowledge of a credential.", + "ImpactStatement": "AWS will soon end support for SMS multi-factor authentication (MFA). New customers are not allowed to use this feature. We recommend that existing customers switch to an alternative method of MFA.", + "RemediationProcedure": "Perform the following to enable MFA: **From Console:** 1. Sign in to the AWS Management Console and open the IAM console at 'https://console.aws.amazon.com/iam/' 2. In the left pane, select `Users`. 3. In the `User Name` list, choose the name of the intended MFA user. 4. Choose the `Security Credentials` tab, and then choose `Manage MFA Device`. 5. In the `Manage MFA Device wizard`, choose `Virtual MFA` device, and then choose `Continue`. IAM generates and displays configuration information for the virtual MFA device, including a QR code graphic. The graphic is a representation of the 'secret configuration key' that is available for manual entry on devices that do not support QR codes. 6. Open your virtual MFA application. (For a list of apps that you can use for hosting virtual MFA devices, see Virtual MFA Applications at https://aws.amazon.com/iam/details/mfa/#Virtual_MFA_Applications). If the virtual MFA application supports multiple accounts (multiple virtual MFA devices), choose the option to create a new account (a new virtual MFA device). 7. Determine whether the MFA app supports QR codes, and then do one of the following: - Use the app to scan the QR code. For example, you might choose the camera icon or choose an option similar to Scan code, and then use the device's camera to scan the code. - In the Manage MFA Device wizard, choose Show secret key for manual configuration, and then type the secret configuration key into your MFA application. When you are finished, the virtual MFA device starts generating one-time passwords. 8. In the `Manage MFA Device wizard`, in the `MFA Code 1 box`, type the `one-time password` that currently appears in the virtual MFA device. Wait up to 30 seconds for the device to generate a new one-time password. Then type the second `one-time password` into the `MFA Code 2 box`. 9. Click `Assign MFA`.", + "AuditProcedure": "Perform the following to determine if a MFA device is enabled for all IAM users having a console password: **From Console:** 1. Open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 2. In the left pane, select `Users` 3. If the `MFA` or `Password age` columns are not visible in the table, click the gear icon at the upper right corner of the table and ensure a checkmark is next to both, then click `Close`. 4. Ensure that for each user where the `Password age` column shows a password age, the `MFA` column shows `Virtual`, `U2F Security Key`, or `Hardware`. **From Command Line:** 1. Run the following command (OSX/Linux/UNIX) to generate a list of all IAM users along with their password and MFA status: ``` aws iam generate-credential-report ``` ``` aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,8 ``` 2. The output of this command will produce a table similar to the following: ``` user,password_enabled,mfa_active elise,false,false brandon,true,true rakesh,false,false helene,false,false paras,true,true anitha,false,false ``` 3. For any column having `password_enabled` set to `true` , ensure `mfa_active` is also set to `true.`", + "AdditionalInformation": "**Forced IAM User Self-Service Remediation** Amazon has published a pattern that requires users to set up MFA through self-service before they gain access to their complete set of permissions. Until they complete this step, they cannot access their full permissions. This pattern can be used for new AWS accounts. It can also be applied to existing accounts; it is recommended that users receive instructions and a grace period to complete MFA enrollment before active enforcement on existing AWS accounts.", + "References": "https://tools.ietf.org/html/rfc6238:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#enable-mfa-for-privileged-users:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html:https://blogs.aws.amazon.com/security/post/Tx2SJJYE082KBUK/How-to-Delegate-Management-of-Multi-Factor-Authentication-to-AWS-IAM-Users", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.1", + "Description": "Do not create access keys during initial setup for IAM users with a console password", + "Checks": [ + "iam_user_no_setup_initial_access_key" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Manual", + "Description": "AWS console defaults to no check boxes selected when creating a new IAM user. When creating the IAM User credentials you have to determine what type of access they require. Programmatic access: The IAM user might need to make API calls, use the AWS CLI, or use the Tools for Windows PowerShell. In that case, create an access key (access key ID and a secret access key) for that user. AWS Management Console access: If the user needs to access the AWS Management Console, create a password for the user.", + "RationaleStatement": "Requiring the additional steps to be taken by the user for programmatic access after their profile has been created will provide a stronger indication of intent that access keys are [a] necessary for their work and [b] that once the access key is established on an account, the keys may be in use somewhere in the organization. **Note**: Even if it is known the user will need access keys, require them to create the keys themselves or put in a support ticket to have them created as a separate step from user creation.", + "ImpactStatement": "", + "RemediationProcedure": "Perform the following to delete access keys that do not pass the audit: **From Console:** 1. Login to the AWS Management Console: 2. Click `Services` 3. Click `IAM` 4. Click on `Users` 5. Click on `Security Credentials` 6. As an Administrator - Click on the X `(Delete)` for keys that were created at the same time as the user profile but have not been used. 7. As an IAM User - Click on the X `(Delete)` for keys that were created at the same time as the user profile but have not been used. **From Command Line:** ``` aws iam delete-access-key --access-key-id --user-name ```", + "AuditProcedure": "Perform the following steps to determine if unused access keys were created upon user creation: **From Console:** 1. Login to the AWS Management Console 2. Click `Services` 3. Click `IAM` 4. Click on a User where column `Password age` and `Access key age` is not set to `None` 5. Click on `Security credentials` Tab 6. Compare the user `Creation time` to the Access Key `Created` date. 6. For any that match, the key was created during initial user setup. - Keys that were created at the same time as the user profile and do not have a last used date should be deleted. Refer to the remediation below. **From Command Line:** 1. Run the following command (OSX/Linux/UNIX) to generate a list of all IAM users along with their access keys utilization: ``` aws iam generate-credential-report ``` ``` aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,9,11,14,16 ``` 2. The output of this command will produce a table similar to the following: ``` user,password_enabled,access_key_1_active,access_key_1_last_used_date,access_key_2_active,access_key_2_last_used_date elise,false,true,2015-04-16T15:14:00+00:00,false,N/A brandon,true,true,N/A,false,N/A rakesh,false,false,N/A,false,N/A helene,false,true,2015-11-18T17:47:00+00:00,false,N/A paras,true,true,2016-08-28T12:04:00+00:00,true,2016-03-04T10:11:00+00:00 anitha,true,true,2016-06-08T11:43:00+00:00,true,N/A ``` 3. For any user having `password_enabled` set to `true` AND `access_key_last_used_date` set to `N/A` refer to the remediation below.", + "AdditionalInformation": "Credential report does not appear to contain Key Creation Date", + "References": "https://docs.aws.amazon.com/cli/latest/reference/iam/delete-access-key.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.11", + "Description": "Ensure credentials unused for 45 days or more are disabled", + "Checks": [ + "iam_user_accesskey_unused", + "iam_user_console_access_unused" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused for 45 days or more be deactivated or removed.", + "RationaleStatement": "Disabling or removing unnecessary credentials will reduce the window of opportunity for credentials associated with a compromised or abandoned account to be used.", + "ImpactStatement": "", + "RemediationProcedure": "**From Console:** Perform the following to manage Unused Password (IAM user console access) 1. Login to the AWS Management Console: 2. Click `Services` 3. Click `IAM` 4. Click on `Users` 5. Click on `Security Credentials` 6. Select user whose `Console last sign-in` is greater than 45 days 7. Click `Security credentials` 8. In section `Sign-in credentials`, `Console password` click `Manage` 9. Under Console Access select `Disable` 10. Click `Apply` Perform the following to deactivate Access Keys: 1. Login to the AWS Management Console: 2. Click `Services` 3. Click `IAM` 4. Click on `Users` 5. Click on `Security Credentials` 6. Select any access keys that are over 45 days old and that have been used and - Click on `Make Inactive` 7. Select any access keys that are over 45 days old and that have not been used and - Click the X to `Delete`", + "AuditProcedure": "Perform the following to determine if unused credentials exist: **From Console:** 1. Login to the AWS Management Console 2. Click `Services` 3. Click `IAM` 4. Click on `Users` 5. Click the `Settings` (gear) icon. 6. Select `Console last sign-in`, `Access key last used`, and `Access Key Id` 7. Click on `Close` 8. Check and ensure that `Console last sign-in` is less than 45 days ago. **Note** - `Never` means the user has never logged in. 9. Check and ensure that `Access key age` is less than 45 days and that `Access key last used` does not say `None` If the user hasn't signed into the Console in the last 45 days or Access keys are over 45 days old refer to the remediation. **From Command Line:** **Download Credential Report:** 1. Run the following commands: ``` aws iam generate-credential-report aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,5,6,9,10,11,14,15,16 | grep -v '^' ``` **Ensure unused credentials do not exist:** 2. For each user having `password_enabled` set to `TRUE` , ensure `password_last_used_date` is less than `45` days ago. - When `password_enabled` is set to `TRUE` and `password_last_used` is set to `No_Information` , ensure `password_last_changed` is less than 45 days ago. 3. For each user having an `access_key_1_active` or `access_key_2_active` to `TRUE` , ensure the corresponding `access_key_n_last_used_date` is less than `45` days ago. - When a user having an `access_key_x_active` (where x is 1 or 2) to `TRUE` and corresponding access_key_x_last_used_date is set to `N/A`, ensure `access_key_x_last_rotated` is less than 45 days ago.", + "AdditionalInformation": " is excluded in the audit since the root account should not be used for day-to-day business and would likely be unused for more than 45 days.", + "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#remove-credentials:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_finding-unused.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_admin-change-user.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.12", + "Description": "Ensure there is only one active access key for any single IAM user", + "Checks": [ + "iam_user_two_active_access_key" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)", + "RationaleStatement": "One of the best ways to protect your account is to not allow users to have multiple access keys.", + "ImpactStatement": "", + "RemediationProcedure": "**From Console:** 1. Sign in to the AWS Management Console and navigate to IAM dashboard at `https://console.aws.amazon.com/iam/`. 2. In the left navigation panel, choose `Users`. 3. Click on the IAM user name that you want to examine. 4. On the IAM user configuration page, select `Security Credentials` tab. 5. In `Access Keys` section, choose one access key that is less than 90 days old. This should be the only active key used by this IAM user to access AWS resources programmatically. Test your application(s) to make sure that the chosen access key is working. 6. In the same `Access Keys` section, identify your non-operational access keys (other than the chosen one) and deactivate it by clicking the `Make Inactive` link. 7. If you receive the `Change Key Status` confirmation box, click `Deactivate` to switch off the selected key. 8. Repeat steps 3-7 for each IAM user in your AWS account. **From Command Line:** 1. Using the IAM user and access key information provided in the `Audit CLI`, choose one access key that is less than 90 days old. This should be the only active key used by this IAM user to access AWS resources programmatically. Test your application(s) to make sure that the chosen access key is working. 2. Run the `update-access-key` command below using the IAM user name and the non-operational access key IDs to deactivate the unnecessary key(s). Refer to the Audit section to identify the unnecessary access key ID for the selected IAM user **Note** - the command does not return any output: ``` aws iam update-access-key --access-key-id --status Inactive --user-name ``` 3. To confirm that the selected access key pair has been successfully `deactivated` run the `list-access-keys` audit command again for that IAM User: ``` aws iam list-access-keys --user-name ``` - The command output should expose the metadata for each access key associated with the IAM user. If the non-operational key pair(s) `Status` is set to `Inactive`, the key has been successfully deactivated and the IAM user access configuration adheres now to this recommendation. 4. Repeat steps 1-3 for each IAM user in your AWS account.", + "AuditProcedure": "**From Console:** 1. Sign in to the AWS Management Console and navigate to IAM dashboard at `https://console.aws.amazon.com/iam/`. 2. In the left navigation panel, choose `Users`. 3. Click on the IAM user name that you want to examine. 4. On the IAM user configuration page, select `Security Credentials` tab. 5. Under `Access Keys` section, in the Status column, check the current status for each access key associated with the IAM user. If the selected IAM user has more than one access key activated, then the user's access configuration does not adhere to security best practices, and the risk of accidental exposures increases. - Repeat steps 3-5 for each IAM user in your AWS account. **From Command Line:** 1. Run `list-users` command to list all IAM users within your account: ``` aws iam list-users --query Users[*].UserName ``` The command output should return an array that contains all your IAM user names. 2. Run `list-access-keys` command using the IAM user name list to return the current status of each access key associated with the selected IAM user: ``` aws iam list-access-keys --user-name ``` The command output should expose the metadata `(Username, AccessKeyId, Status, CreateDate)` for each access key on that user account. 3. Check the `Status` property value for each key returned to determine each key's current state. If the `Status` property value for more than one IAM access key is set to `Active`, the user access configuration does not adhere to this recommendation; refer to the remediation below. - Repeat steps 2 and 3 for each IAM user in your AWS account.", + "AdditionalInformation": "", + "References": "https://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.13", + "Description": "Ensure access keys are rotated every 90 days or less", + "Checks": [ + "iam_rotate_access_key_90_days" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be rotated regularly.", + "RationaleStatement": "Rotating access keys will reduce the window of opportunity for an access key that is associated with a compromised or terminated account to be used. Access keys should be rotated to ensure that data cannot be accessed with an old key which might have been lost, cracked, or stolen.", + "ImpactStatement": "", + "RemediationProcedure": "Perform the following to rotate access keys: **From Console:** 1. Go to the Management Console (https://console.aws.amazon.com/iam) 2. Click on `Users` 3. Click on `Security Credentials` 4. As an Administrator - Click on `Make Inactive` for keys that have not been rotated in `90` Days 5. As an IAM User - Click on `Make Inactive` or `Delete` for keys which have not been rotated or used in `90` Days 6. Click on `Create Access Key` 7. Update programmatic calls with new Access Key credentials **From Command Line:** 1. While the first access key is still active, create a second access key, which is active by default. Run the following command: ``` aws iam create-access-key ``` At this point, the user has two active access keys. 2. Update all applications and tools to use the new access key. 3. Determine whether the first access key is still in use by using this command: ``` aws iam get-access-key-last-used ``` 4. One approach is to wait several days and then check the old access key for any use before proceeding. Even if step 3 indicates no use of the old key, it is recommended that you do not immediately delete the first access key. Instead, change the state of the first access key to Inactive using this command: ``` aws iam update-access-key ``` 5. Use only the new access key to confirm that your applications are working. Any applications and tools that still use the original access key will stop working at this point because they no longer have access to AWS resources. If you find such an application or tool, you can switch its state back to Active to reenable the first access key. Then return to step 2 and update this application to use the new key. 6. After you wait some period of time to ensure that all applications and tools have been updated, you can delete the first access key with this command: ``` aws iam delete-access-key ```", + "AuditProcedure": "Perform the following to determine if access keys are rotated as prescribed: **From Console:** 1. Go to the Management Console (https://console.aws.amazon.com/iam) 2. Click on `Users` 3. For each user, go to `Security Credentials` 4. Review each key under `Access Keys` 5. For each key that shows `Active` for status, ensure that `Created` is less than or equal to `90 days ago`. **From Command Line:** ``` aws iam generate-credential-report aws iam get-credential-report --query 'Content' --output text | base64 -d ``` The `access_key_1_last_rotated` and the `access_key_2_last_rotated` fields in this file notes the date and time, in ISO 8601 date-time format, when the user's access key was created or last changed. If the user does not have an active access key, the value in this field is N/A (not applicable).", + "AdditionalInformation": "", + "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#rotate-credentials:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_finding-unused.html:https://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.14", + "Description": "Ensure IAM users receive permissions only through groups", + "Checks": [ + "iam_policy_attached_only_to_group_or_roles" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "IAM users are granted access to services, functions, and data through IAM policies. There are four ways to define policies for a user: 1) Edit the user policy directly, also known as an inline or user policy; 2) attach a policy directly to a user; 3) add the user to an IAM group that has an attached policy; 4) add the user to an IAM group that has an inline policy. Only the third implementation is recommended.", + "RationaleStatement": "Assigning IAM policies solely through groups unifies permissions management into a single, flexible layer that is consistent with organizational functional roles. By unifying permissions management, the likelihood of excessive permissions is reduced.", + "ImpactStatement": "", + "RemediationProcedure": "Perform the following to create an IAM group and assign a policy to it: 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 2. In the navigation pane, click `Groups` and then click `Create New Group`. 3. In the `Group Name` box, type the name of the group and then click `Next Step`. 4. In the list of policies, select the check box for each policy that you want to apply to all members of the group. Then click `Next Step`. 5. Click `Create Group`. Perform the following to add a user to a given group: 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 2. In the navigation pane, click `Groups`. 3. Select the group to add a user to. 4. Click `Add Users To Group`. 5. Select the users to be added to the group. 6. Click `Add Users`. Perform the following to remove a direct association between a user and policy: 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 2. In the left navigation pane, click on Users. 3. For each user: - Select the user - Click on the `Permissions` tab - Expand `Permissions policies` - Click `X` for each policy; then click Detach or Remove (depending on policy type)", + "AuditProcedure": "Perform the following to determine if an inline policy is set or a policy is directly attached to users: 1. Run the following to get a list of IAM users: ``` aws iam list-users --query 'Users[*].UserName' --output text ``` 2. For each user returned, run the following command to determine if any policies are attached to them: ``` aws iam list-attached-user-policies --user-name aws iam list-user-policies --user-name ``` 3. If any policies are returned, the user has an inline policy or direct policy attachment.", + "AdditionalInformation": "", + "References": "http://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html:http://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.15", + "Description": "Ensure IAM policies that allow full *:* administrative privileges are not attached", + "Checks": [ + "iam_aws_attached_policy_no_administrative_privileges", + "iam_customer_attached_policy_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered standard security advice to grant least privilege—that is, granting only the permissions required to perform a task. Determine what users need to do, and then craft policies for them that allow the users to perform only those tasks, instead of granting full administrative privileges.", + "RationaleStatement": "It's more secure to start with a minimum set of permissions and grant additional permissions as necessary, rather than starting with permissions that are too lenient and then attempting to tighten them later. Providing full administrative privileges instead of restricting access to the minimum set of permissions required for the user exposes resources to potentially unwanted actions. IAM policies that contain a statement with `Effect: Allow` and `Action: *` over `Resource: *` should be removed.", + "ImpactStatement": "", + "RemediationProcedure": "**From Console:** Perform the following to detach the policy that has full administrative privileges: 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 2. In the navigation pane, click Policies and then search for the policy name found in the audit step. 3. Select the policy that needs to be deleted. 4. In the policy action menu, select `Detach`. 5. Select all Users, Groups, Roles that have this policy attached. 6. Click `Detach Policy`. 7. Select the newly detached policy and select `Delete`. **From Command Line:** Perform the following to detach the policy that has full administrative privileges as found in the audit step: 1. Lists all IAM users, groups, and roles that the specified managed policy is attached to. ``` aws iam list-entities-for-policy --policy-arn ``` 2. Detach the policy from all IAM Users: ``` aws iam detach-user-policy --user-name --policy-arn ``` 3. Detach the policy from all IAM Groups: ``` aws iam detach-group-policy --group-name --policy-arn ``` 4. Detach the policy from all IAM Roles: ``` aws iam detach-role-policy --role-name --policy-arn ```", + "AuditProcedure": "Perform the following to determine existing policies: **From Command Line:** 1. Run the following to get a list of IAM policies: ``` aws iam list-policies --only-attached --output text ``` 2. For each policy returned, run the following command to determine if any policy is allowing full administrative privileges on the account: ``` aws iam get-policy-version --policy-arn --version-id ``` 3. In the output, the policy should not contain any Statement block with `Effect: Allow` and `Action` set to `*` and `Resource` set to `*`.", + "AdditionalInformation": "", + "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html:https://docs.aws.amazon.com/cli/latest/reference/iam/index.html#cli-aws-iam", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.16", + "Description": "Ensure a support role has been created to manage incidents with AWS Support", + "Checks": [ + "iam_support_role_created" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role, with the appropriate policy assigned, to allow authorized users to manage incidents with AWS Support.", + "RationaleStatement": "By implementing least privilege for access control, an IAM Role will require an appropriate IAM Policy to allow Support Center Access in order to manage Incidents with AWS Support.", + "ImpactStatement": "All AWS Support plans include an unlimited number of account and billing support cases, with no long-term contracts. Support billing calculations are performed on a per-account basis for all plans. Enterprise Support plan customers have the option to include multiple enabled accounts in an aggregated monthly billing calculation. Monthly charges for the Business and Enterprise support plans are based on each month's AWS usage charges, subject to a monthly minimum, billed in advance. When assigning rights, keep in mind that other policies may grant access to Support as well. This may include AdministratorAccess and other policies including customer managed policies. Utilizing the AWS managed 'AWSSupportAccess' role is one simple way of ensuring that this permission is properly granted. To better support the principle of separation of duties, it would be best to only attach this role where necessary.", + "RemediationProcedure": "**From Command Line:** 1. Create an IAM role for managing incidents with AWS: - Create a trust relationship policy document that allows to manage AWS incidents, and save it locally as /tmp/TrustPolicy.json: ``` { Version: 2012-10-17, Statement: [ { Effect: Allow, Principal: { AWS: }, Action: sts:AssumeRole } ] } ``` 2. Create the IAM role using the above trust policy: ``` aws iam create-role --role-name --assume-role-policy-document file:///tmp/TrustPolicy.json ``` 3. Attach 'AWSSupportAccess' managed policy to the created IAM role: ``` aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess --role-name ```", + "AuditProcedure": "**From Command Line:** 1. List IAM policies, filter for the 'AWSSupportAccess' managed policy, and note the Arn element value: ``` aws iam list-policies --query Policies[?PolicyName == 'AWSSupportAccess'] ``` 2. Check if the 'AWSSupportAccess' policy is attached to any role: ``` aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess ``` 3. In the output, ensure `PolicyRoles` does not return empty. 'Example: Example: PolicyRoles: [ ]' If it returns empty refer to the remediation below.", + "AdditionalInformation": "AWSSupportAccess policy is a global AWS resource. It has same ARN as `arn:aws:iam::aws:policy/AWSSupportAccess` for every account.", + "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html:https://aws.amazon.com/premiumsupport/pricing/:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-policies.html:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/attach-role-policy.html:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-entities-for-policy.html", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.17", + "Description": "Ensure IAM instance roles are used for AWS resource access from instances", + "Checks": [ + "ec2_instance_profile_attached" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 2", + "AssessmentStatus": "Automated", + "Description": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. AWS Access means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.", + "RationaleStatement": "AWS IAM roles reduce the risks associated with sharing and rotating credentials that can be used outside of AWS itself. Compromised credentials can be used from outside the AWS account to which they provide access. In contrast, to leverage role permissions, an attacker would need to gain and maintain access to a specific instance to use the privileges associated with it. Additionally, if credentials are encoded into compiled applications or other hard-to-change mechanisms, they are even less likely to be properly rotated due to the risks of service disruption. As time passes, credentials that cannot be rotated are more likely to be known by an increasing number of individuals who no longer work for the organization that owns the credentials.", + "ImpactStatement": "", + "RemediationProcedure": "**From Console:** 1. Sign in to the AWS Management Console and navigate to the EC2 dashboard at `https://console.aws.amazon.com/ec2/`. 2. In the left navigation panel, choose `Instances`. 3. Select the EC2 instance you want to modify. 4. Click `Actions`. 5. Click `Security`. 6. Click `Modify IAM role`. 7. Click `Create new IAM role` if a new IAM role is required. 8. Select the IAM role you want to attach to your instance in the `IAM role` dropdown. 9. Click `Update IAM role`. 10. Repeat steps 3 to 9 for each EC2 instance in your AWS account that requires an IAM role to be attached. **From Command Line:** 1. Run the `describe-instances` command to list all EC2 instance IDs in the selected AWS region: ``` aws ec2 describe-instances --region --query 'Reservations[*].Instances[*].InstanceId' ``` 2. Run the `associate-iam-instance-profile` command to attach an instance profile (which is attached to an IAM role) to the EC2 instance: ``` aws ec2 associate-iam-instance-profile --region --instance-id --iam-instance-profile Name=Instance-Profile-Name ``` 3. Run the `describe-instances` command again for the recently modified EC2 instance. The command output should return the instance profile ARN and ID: ``` aws ec2 describe-instances --region --instance-id --query 'Reservations[*].Instances[*].IamInstanceProfile' ``` 4. Repeat steps 2 and 3 for each EC2 instance in your AWS account that requires an IAM role to be attached.", + "AuditProcedure": "First, check if the instance has any API secrets stored using Secret Scanning. Currently, AWS does not have a solution for this. You can use open-source tools like TruffleHog to scan for secrets in the EC2 instance. If a secret is found, then assign the role to the instance. **From Console:** 1. Sign in to the AWS Management Console and navigate to the EC2 dashboard at `https://console.aws.amazon.com/ec2/`. 2. In the left navigation panel, choose `Instances`. 3. Select the EC2 instance you want to examine. 4. Select `Actions`. 5. Select `View details`. 6. Select `Security` in the lower panel. - If the value for **Instance profile arn** is an instance profile ARN, then an instance profile (that contains an IAM role) is attached. - If the value for **IAM Role** is blank, no role is attached. - If the value for **IAM Role** contains a role, a role is attached. - If the value for **IAM Role** is No roles attached to instance profile: , then an instance profile is attached to the instance, but it does not contain an IAM role. 7. Repeat steps 3 to 6 for each EC2 instance in your AWS account. **From Command Line:** 1. Run the `describe-instances` command to list all EC2 instance IDs in the selected AWS region: ``` aws ec2 describe-instances --region --query 'Reservations[*].Instances[*].InstanceId' ``` 2. Run the `describe-instances` command again for each EC2 instance using the `IamInstanceProfile` identifier in the query filter to check if an IAM role is attached: ``` aws ec2 describe-instances --region --instance-id --query 'Reservations[*].Instances[*].IamInstanceProfile' ``` 3. If an IAM role is attached, the command output will show the IAM instance profile ARN and ID. 4. Repeat steps 2 and 3 for each EC2 instance in your AWS account.", + "AdditionalInformation": "", + "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.18", + "Description": "Ensure that all expired SSL/TLS certificates stored in AWS IAM are removed", + "Checks": [ + "iam_no_expired_server_certificates_stored" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use AWS Certificate Manager (ACM) or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.", + "RationaleStatement": "Removing expired SSL/TLS certificates eliminates the risk that an invalid certificate will be deployed accidentally to a resource such as AWS Elastic Load Balancer (ELB), which can damage the credibility of the application/website behind the ELB. As a best practice, it is recommended to delete expired certificates.", + "ImpactStatement": "Deleting the certificate could have implications for your application if you are using an expired server certificate with Elastic Load Balancing, CloudFront, etc. You must make configurations in the respective services to ensure there is no interruption in application functionality.", + "RemediationProcedure": "**From Console:** Removing expired certificates via AWS Management Console is not currently supported. To delete SSL/TLS certificates stored in IAM through the AWS API, use the Command Line Interface (CLI). **From Command Line:** To delete an expired certificate, run the following command by replacing with the name of the certificate to delete: ``` aws iam delete-server-certificate --server-certificate-name ``` When the preceding command is successful, it does not return any output.", + "AuditProcedure": "**From Console:** Getting the certificate expiration information via the AWS Management Console is not currently supported. To request information about the SSL/TLS certificates stored in IAM through the AWS API, use the Command Line Interface (CLI). **From Command Line:** Run the `list-server-certificates` command to list all the IAM-stored server certificates: ``` aws iam list-server-certificates ``` The command output should return an array that contains all the SSL/TLS certificates currently stored in IAM and their metadata (name, ID, expiration date, etc): ``` { ServerCertificateMetadataList: [ { ServerCertificateId: EHDGFRW7EJFYTE88D, ServerCertificateName: MyServerCertificate, Expiration: 2018-07-10T23:59:59Z, Path: /, Arn: arn:aws:iam::012345678910:server-certificate/MySSLCertificate, UploadDate: 2018-06-10T11:56:08Z } ] } ``` Verify the `ServerCertificateName` and `Expiration` parameter value (expiration date) for each SSL/TLS certificate returned by the list-server-certificates command and determine if there are any expired server certificates currently stored in AWS IAM. If so, use the AWS API to remove them. If this command returns: ``` { { ServerCertificateMetadataList: [] } ``` This means that there are no expired certificates; it **does not** mean that no certificates exist.", + "AdditionalInformation": "", + "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-server-certificate.html", + "DefaultValue": "By default, expired certificates will not be deleted." + } + ] + }, + { + "Id": "1.19", + "Description": "Ensure that IAM External Access Analyzer is enabled for all regions", + "Checks": [ + "accessanalyzer_enabled" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "Enable the IAM External Access Analyzer regarding all resources in each active AWS region. IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. The results allow you to determine whether an unintended user is permitted, making it easier for administrators to monitor least privilege access. Access Analyzer analyzes only the policies that are applied to resources in the same AWS Region.", + "RationaleStatement": "AWS IAM External Access Analyzer helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared with external entities. This allows you to identify unintended access to your resources and data. Access Analyzer identifies resources that are shared with external principals by using logic-based reasoning to analyze the resource-based policies in your AWS environment. IAM External Access Analyzer continuously monitors all policies for S3 buckets, IAM roles, KMS (Key Management Service) keys, AWS Lambda functions, Amazon SQS (Simple Queue Service) queues and more", + "ImpactStatement": "", + "RemediationProcedure": "**From Console:** Perform the following to enable IAM Access Analyzer for IAM policies: 1. Open the IAM console at `https://console.aws.amazon.com/iam/.` 2. Choose `Access analyzer`. 3. Choose `Create external access analyzer`. 4. On the `Create analyzer` page, confirm that the `Region` displayed is the Region where you want to enable Access Analyzer. 5. Optionally enter a name for the analyzer. 6. Optionally add any tags that you want to apply to the analyzer. 7. Choose `Create Analyzer`. 8. Repeat these step for each active region. **From Command Line:** Run the following command: ``` aws accessanalyzer create-analyzer --analyzer-name --type ``` Repeat this command for each active region. **Note:** The IAM Access Analyzer is successfully configured only when the account you use has the necessary permissions.", + "AuditProcedure": "**From Console:** 1. Open the IAM console at `https://console.aws.amazon.com/iam/` 2. Under `Access analyzer` choose `External Access` 3. Ensure that at least one analyzer is present 4. Ensure that the `STATUS` is set to `Active` 5. Repeat these steps for each active region **From Command Line:** 1. Run the following command: ``` aws accessanalyzer list-analyzers type -- | grep status ``` 2. Ensure that at least one Analyzer's `status` is set to `ACTIVE`. 3. Repeat the steps above for each active region. If an Access Analyzer is not listed for each region or the status is not set to active refer to the remediation procedure below.", + "AdditionalInformation": "Some regions in AWS are enabled by default, while others are disabled by default. Regions introduced prior to March 20, 2019, are enabled by default and cannot be disabled. Regions introduced afterward can be disabled by default. For more information on managing AWS Regions, please see AWS's [documentation on managing AWS Regions](https://docs.aws.amazon.com/general/latest/gr/rande-manage.html).", + "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-getting-started.html:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/accessanalyzer/get-analyzer.html:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/accessanalyzer/create-analyzer.html", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.20", + "Description": "Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments", + "Checks": [ + "iam_check_saml_providers_sts" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 2", + "AssessmentStatus": "Manual", + "Description": "In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.", + "RationaleStatement": "Centralizing IAM user management to a single identity store reduces complexity and thus the likelihood of access management errors.", + "ImpactStatement": "", + "RemediationProcedure": "The remediation procedure will vary based on each individual organization's implementation of identity federation and/or AWS Organizations, with the acceptance criteria that no non-service IAM users and non-root accounts are present outside the account providing centralized IAM user management.", + "AuditProcedure": "For multi-account AWS environments with an external identity provider: 1. Determine the master account for identity federation or IAM user management 2. Login to that account through the AWS Management Console 3. Click `Services` 4. Click `IAM` 5. Click `Identity providers` 6. Verify the configuration For multi-account AWS environments with an external identity provider, as well as for those implementing AWS Organizations without an external identity provider: 1. Determine all accounts that should not have local users present 2. Log into the AWS Management Console 3. Switch role into each identified account 4. Click `Services` 5. Click `IAM` 6. Click `Users` 7. Confirm that no IAM users representing individuals are present", + "AdditionalInformation": "", + "References": "", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.21", + "Description": "Ensure access to AWSCloudShellFullAccess is restricted", + "Checks": [ + "iam_policy_cloudshell_admin_not_attached" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Manual", + "Description": "AWS CloudShell is a convenient way of running CLI commands against AWS services; a managed IAM policy ('AWSCloudShellFullAccess') provides full access to CloudShell, which allows file upload and download capability between a user's local system and the CloudShell environment. Within the CloudShell environment, a user has sudo permissions and can access the internet. Therefore, it is feasible to install file transfer software, for example, and move data from CloudShell to external internet servers.", + "RationaleStatement": "Access to this policy should be restricted, as it presents a potential channel for data exfiltration by malicious cloud admins who are given full permissions to the service. AWS documentation describes how to create a more restrictive IAM policy that denies file transfer permissions.", + "ImpactStatement": "", + "RemediationProcedure": "**From Console** 1. Open the IAM console at https://console.aws.amazon.com/iam/ 2. In the left pane, select Policies 3. Search for and select AWSCloudShellFullAccess 4. On the Entities attached tab, for each item, check the box and select Detach", + "AuditProcedure": "**From Console** 1. Open the IAM console at https://console.aws.amazon.com/iam/ 2. In the left pane, select Policies 3. Search for and select AWSCloudShellFullAccess 4. On the Entities attached tab, ensure that there are no entities using this policy **From Command Line** 1. List IAM policies, filter for the 'AWSCloudShellFullAccess' managed policy, and note the Arn element value: ``` aws iam list-policies --query Policies[?PolicyName == 'AWSCloudShellFullAccess'] ``` 2. Check if the 'AWSCloudShellFullAccess' policy is attached to any role: ``` aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AWSCloudShellFullAccess ``` 3. In the output, ensure PolicyRoles returns empty. 'Example: Example: PolicyRoles: [ ]' If it does not return empty, refer to the remediation below. **Note:** Keep in mind that other policies may grant access.", + "AdditionalInformation": "", + "References": "https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html", + "DefaultValue": "" + } + ] + }, + { + "Id": "2.1.1", + "Description": "Ensure S3 Bucket Policy is set to deny HTTP requests", + "Checks": [ + "s3_bucket_secure_transport_policy" + ], + "Attributes": [ + { + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", + "Profile": "Level 2", + "AssessmentStatus": "Automated", + "Description": "At the Amazon S3 bucket level, you can configure permissions through a bucket policy, making the objects accessible only through HTTPS.", + "RationaleStatement": "By default, Amazon S3 allows both HTTP and HTTPS requests. To ensure that access to Amazon S3 objects is only permitted through HTTPS, you must explicitly deny HTTP requests. Bucket policies that allow HTTPS requests without explicitly denying HTTP requests will not comply with this recommendation.", + "ImpactStatement": "", + "RemediationProcedure": "**From Console:** 1. Login to the AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/. 2. Select the check box next to the Bucket. 3. Click on 'Permissions'. 4. Click 'Bucket Policy'. 5. Add either of the following to the existing policy, filling in the required information: ``` { Sid: , Effect: Deny, Principal: *, Action: s3:*, Resource: arn:aws:s3:::/*, Condition: { Bool: { aws:SecureTransport: false } } } ``` or ``` { Sid: , Effect: Deny, Principal: *, Action: s3:*, Resource: [ arn:aws:s3:::, arn:aws:s3:::/* ], Condition: { NumericLessThan: { s3:TlsVersion: 1.2 } } } ``` 6. Save 7. Repeat for all the buckets in your AWS account that contain sensitive data. **From Console** Using AWS Policy Generator: 1. Repeat steps 1-4 above. 2. Click on `Policy Generator` at the bottom of the Bucket Policy Editor. 3. Select Policy Type `S3 Bucket Policy`. 4. Add Statements: - `Effect` = Deny - `Principal` = * - `AWS Service` = Amazon S3 - `Actions` = * - `Amazon Resource Name` = 5. Generate Policy. 6. Copy the text and add it to the Bucket Policy. **From Command Line:** 1. Export the bucket policy to a json file: ``` aws s3api get-bucket-policy --bucket --query Policy --output text > policy.json ``` 2. Modify the policy.json file by adding either of the following: ``` { Sid: , Effect: Deny, Principal: *, Action: s3:*, Resource: arn:aws:s3:::/*, Condition: { Bool: { aws:SecureTransport: false } } } ``` or ``` { Sid: , Effect: Deny, Principal: *, Action: s3:*, Resource: [ arn:aws:s3:::, arn:aws:s3:::/* ], Condition: { NumericLessThan: { s3:TlsVersion: 1.2 } } } ``` 3. Apply this modified policy back to the S3 bucket: ``` aws s3api put-bucket-policy --bucket --policy file://policy.json ```", + "AuditProcedure": "To allow access to HTTPS, you can use a bucket policy with the effect `allow` and a condition that checks for the key `aws:SecureTransport: true`. This means that HTTPS requests are allowed, but it does not deny HTTP requests. To explicitly deny HTTP access, ensure that there is also a bucket policy with the effect `deny` that contains the key `aws:SecureTransport: false`. You may also require TLS by setting a policy to deny any version lower than the one you wish to require, using the condition `NumericLessThan` and the key `s3:TlsVersion: 1.2`. **From Console:** 1. Login to the AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/. 2. Select the check box next to the Bucket. 3. Click on 'Permissions', then click on `Bucket Policy`. 4. Ensure that a policy is listed that matches either: ``` { Sid: , Effect: Deny, Principal: *, Action: s3:*, Resource: arn:aws:s3:::/*, Condition: { Bool: { aws:SecureTransport: false } } } ``` or ``` { Sid: , Effect: Deny, Principal: *, Action: s3:*, Resource: [ arn:aws:s3:::, arn:aws:s3:::/* ], Condition: { NumericLessThan: { s3:TlsVersion: 1.2 } } } ``` `` and `` will be specific to your account, and TLS version will be site/policy specific to your organisation. 5. Repeat for all the buckets in your AWS account. **From Command Line:** 1. List all of the S3 Buckets ``` aws s3 ls ``` 2. Using the list of buckets, run this command on each of them: ``` aws s3api get-bucket-policy --bucket | grep aws:SecureTransport ``` or ``` aws s3api get-bucket-policy --bucket | grep s3:TlsVersion ``` NOTE : If an error is thrown by the CLI, it means no policy has been configured for the specified S3 bucket, and that by default it is allowing both HTTP and HTTPS requests. 3. Confirm that `aws:SecureTransport` is set to false (such as `aws:SecureTransport:false`) or that `s3:TlsVersion` has a site-specific value. 4. Confirm that the policy line has Effect set to Deny 'Effect:Deny'", + "AdditionalInformation": "", + "References": "https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-policy-for-config-rule/:https://aws.amazon.com/blogs/security/how-to-use-bucket-policies-and-apply-defense-in-depth-to-help-secure-your-amazon-s3-data/:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/get-bucket-policy.html", + "DefaultValue": "Both HTTP and HTTPS requests are allowed." + } + ] + }, + { + "Id": "2.1.2", + "Description": "Ensure MFA Delete is enabled on S3 buckets", + "Checks": [ + "s3_bucket_no_mfa_delete" + ], + "Attributes": [ + { + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", + "Profile": "Level 2", + "AssessmentStatus": "Manual", + "Description": "Once MFA Delete is enabled on your sensitive and classified S3 bucket, it requires the user to provide two forms of authentication.", + "RationaleStatement": "Adding MFA delete to an S3 bucket requires additional authentication when you change the version state of your bucket or delete an object version, adding another layer of security in the event your security credentials are compromised or unauthorized access is granted.", + "ImpactStatement": "Enabling MFA delete on an S3 bucket could require additional administrator oversight. Enabling MFA delete may impact other services that automate the creation and/or deletion of S3 buckets.", + "RemediationProcedure": "Perform the steps below to enable MFA delete on an S3 bucket: **Note:** - You cannot enable MFA Delete using the AWS Management Console; you must use the AWS CLI or API. - You must use your 'root' account to enable MFA Delete on S3 buckets. **From Command line:** 1. Run the s3api `put-bucket-versioning` command: ``` aws s3api put-bucket-versioning --profile my-root-profile --bucket Bucket_Name --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa “arn:aws:iam::aws_account_id:mfa/root-account-mfa-device passcode” ```", + "AuditProcedure": "Perform the steps below to confirm that MFA delete is configured on an S3 bucket: **From Console:** 1. Login to the S3 console at `https://console.aws.amazon.com/s3/`. 2. Click the `check` box next to the name of the bucket you want to confirm. 3. In the window under `Properties`: - Confirm that Versioning is `Enabled` - Confirm that MFA Delete is `Enabled` **From Command Line:** 1. Run the `get-bucket-versioning` command: ``` aws s3api get-bucket-versioning --bucket my-bucket ``` Example output: ``` Enabled Enabled ``` If the console or CLI output does not show that Versioning and MFA Delete are `enabled`, please refer to the remediation below.", + "AdditionalInformation": "", + "References": "https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html#MultiFactorAuthenticationDelete:https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingMFADelete.html:https://aws.amazon.com/blogs/security/securing-access-to-aws-using-mfa-part-3/:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_lost-or-broken.html", + "DefaultValue": "" + } + ] + }, + { + "Id": "2.1.3", + "Description": "Ensure all data in Amazon S3 has been discovered, classified, and secured when necessary", + "Checks": [ + "macie_is_enabled" + ], + "Attributes": [ + { + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", + "Profile": "Level 2", + "AssessmentStatus": "Manual", + "Description": "Amazon S3 buckets can contain sensitive data that, for security purposes, should be discovered, monitored, classified, and protected. Macie, along with other third-party tools, can automatically provide an inventory of Amazon S3 buckets.", + "RationaleStatement": "Using a cloud service or third-party software to continuously monitor and automate the process of data discovery and classification for S3 buckets through machine learning and pattern matching is a strong defense in protecting that information. Amazon Macie is a fully managed data security and privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS.", + "ImpactStatement": "There is a cost associated with using Amazon Macie, and there is typically a cost associated with third-party tools that perform similar processes and provide protection.", + "RemediationProcedure": "Perform the steps below to enable and configure Amazon Macie: **From Console:** 1. Log on to the Macie console at `https://console.aws.amazon.com/macie/`. 2. Click `Get started`. 3. Click `Enable Macie`. Set up a repository for sensitive data discovery results: 1. In the left pane, under Settings, click `Discovery results`. 2. Make sure `Create bucket` is selected. 3. Create a bucket and enter a name for it. The name must be unique across all S3 buckets, and it must start with a lowercase letter or a number. 4. Click `Advanced`. 5. For block all public access, make sure `Yes` is selected. 6. For KMS encryption, specify the AWS KMS key that you want to use to encrypt the results. The key must be a symmetric customer master key (CMK) that is in the same region as the S3 bucket. 7. Click `Save`. Create a job to discover sensitive data: 1. In the left pane, click `S3 buckets`. Macie displays a list of all the S3 buckets for your account. 2. Check the box for each bucket that you want Macie to analyze as part of the job. 3. Click `Create job`. 4. Click `Quick create`. 5. For the Name and Description step, enter a name and, optionally, a description of the job. 6. Click `Next`. 7. For the Review and create step, click `Submit`. Review your findings: 1. In the left pane, click `Findings`. 2. To view the details of a specific finding, choose any field other than the check box for the finding. If you are using a third-party tool to manage and protect your S3 data, follow the vendor documentation for implementing and configuring that tool.", + "AuditProcedure": "Perform the following steps to determine if Macie is running: **From Console:** 1. Login to the Macie console at https://console.aws.amazon.com/macie/. 2. In the left hand pane, click on `By job` under findings. 3. Confirm that you have a job set up for your S3 buckets. When you log into the Macie console, if you are not taken to the summary page and do not have a job set up and running, then refer to the remediation procedure below. If you are using a third-party tool to manage and protect your S3 data, you meet this recommendation.", + "AdditionalInformation": "", + "References": "https://aws.amazon.com/macie/getting-started/:https://docs.aws.amazon.com/workspaces/latest/adminguide/data-protection.html:https://docs.aws.amazon.com/macie/latest/user/data-classification.html", + "DefaultValue": "" + } + ] + }, + { + "Id": "2.1.4", + "Description": "Ensure that S3 is configured with 'Block Public Access' enabled", + "Checks": [ + "s3_bucket_level_public_access_block", + "s3_account_level_public_access_blocks" + ], + "Attributes": [ + { + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "Amazon S3 provides `Block public access (bucket settings)` and `Block public access (account settings)` to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, `Block public access (bucket settings)` prevents an individual bucket and its contained objects from becoming publicly accessible. Similarly, `Block public access (account settings)` prevents all buckets and their contained objects from becoming publicly accessible across the entire account.", + "RationaleStatement": "Amazon S3 `Block public access (bucket settings)` prevents the accidental or malicious public exposure of data contained within the respective bucket(s). Amazon S3 `Block public access (account settings)` prevents the accidental or malicious public exposure of data contained within all buckets of the respective AWS account. Whether to block public access to all or some buckets is an organizational decision that should be based on data sensitivity, least privilege, and use case.", + "ImpactStatement": "When you apply Block Public Access settings to an account, the settings apply to all AWS regions globally. The settings may not take effect in all regions immediately or simultaneously, but they will eventually propagate to all regions.", + "RemediationProcedure": "**If utilizing Block Public Access (bucket settings)** **From Console:** 1. Login to the AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/. 2. Select the check box next to a bucket. 3. Click 'Edit public access settings'. 4. Click 'Block all public access' 5. Repeat for all the buckets in your AWS account that contain sensitive data. **From Command Line:** 1. List all of the S3 buckets: ``` aws s3 ls ``` 2. Enable Block Public Access on a specific bucket: ``` aws s3api put-public-access-block --bucket --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true ``` **If utilizing Block Public Access (account settings)** **From Console:** If the output reads `true` for the separate configuration settings, then Block Public Access is enabled on the account. 1. Login to the AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/. 2. Click `Block Public Access (account settings)`. 3. Click `Edit` to change the block public access settings for all the buckets in your AWS account. 4. Update the settings and click `Save`. For details about each setting, pause on the `i` icons. 5. When you're asked for confirmation, enter `confirm`. Then click `Confirm` to save your changes. **From Command Line:** To enable Block Public Access for this account, run the following command: ``` aws s3control put-public-access-block --public-access-block-configuration BlockPublicAcls=true, IgnorePublicAcls=true, BlockPublicPolicy=true, RestrictPublicBuckets=true --account-id ```", + "AuditProcedure": "**If utilizing Block Public Access (bucket settings)** **From Console:** 1. Login to the AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/. 2. Select the check box next to a bucket. 3. Click on 'Edit public access settings'. 4. Ensure that the block public access settings are configured appropriately for this bucket. 5. Repeat for all the buckets in your AWS account. **From Command Line:** 1. List all of the S3 buckets: ``` aws s3 ls ``` 2. Find the public access settings for a specific bucket: ``` aws s3api get-public-access-block --bucket ``` Output if Block Public Access is enabled: ``` { PublicAccessBlockConfiguration: { BlockPublicAcls: true, IgnorePublicAcls: true, BlockPublicPolicy: true, RestrictPublicBuckets: true } } ``` If the output reads `false` for the separate configuration settings, then proceed with the remediation. **If utilizing Block Public Access (account settings)** **From Console:** 1. Login to the AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/. 2. Choose `Block public access (account settings)`. 3. Ensure that the block public access settings are configured appropriately for your AWS account. **From Command Line:** To check the block public access settings for this account, run the following command: `aws s3control get-public-access-block --account-id --region ` Output if Block Public Access is enabled: ``` { PublicAccessBlockConfiguration: { IgnorePublicAcls: true, BlockPublicPolicy: true, BlockPublicAcls: true, RestrictPublicBuckets: true } } ``` If the output reads `false` for the separate configuration settings, then proceed with the remediation.", + "AdditionalInformation": "", + "References": "https://docs.aws.amazon.com/AmazonS3/latest/user-guide/block-public-access-account.html", + "DefaultValue": "" + } + ] + }, + { + "Id": "2.2.1", + "Description": "Ensure that encryption-at-rest is enabled for RDS instances", + "Checks": [ + "rds_instance_storage_encrypted" + ], + "Attributes": [ + { + "Section": "2 Storage", + "SubSection": "2.2 Relational Database Service (RDS)", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "Amazon RDS encrypted DB instances use the industry-standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles the authentication of access and the decryption of your data transparently, with minimal impact on performance.", + "RationaleStatement": "Databases are likely to hold sensitive and critical data; therefore, it is highly recommended to implement encryption to protect your data from unauthorized access or disclosure. With RDS encryption enabled, the data stored on the instance's underlying storage, the automated backups, read replicas, and snapshots are all encrypted.", + "ImpactStatement": "", + "RemediationProcedure": "**From Console:** 1. Login to the AWS Management Console and open the RDS dashboard at https://console.aws.amazon.com/rds/. 2. In the left navigation panel, click on `Databases`. 3. Select the Database instance that needs to be encrypted. 4. Click the `Actions` button placed at the top right and select `Take Snapshot`. 5. On the Take Snapshot page, enter the name of the database for which you want to take a snapshot in the `Snapshot Name` field and click on `Take Snapshot`. 6. Select the newly created snapshot, click the `Action` button placed at the top right, and select `Copy snapshot` from the Action menu. 7. On the Make Copy of DB Snapshot page, perform the following: - In the `New DB Snapshot Identifier` field, enter a name for the new snapshot. - Check `Copy Tags`. The new snapshot must have the same tags as the source snapshot. - Select `Yes` from the `Enable Encryption` dropdown list to enable encryption. You can choose to use the AWS default encryption key or a custom key from the Master Key dropdown list. 8. Click `Copy Snapshot` to create an encrypted copy of the selected instance's snapshot. 9. Select the new Snapshot Encrypted Copy and click the `Action` button located at the top right. Then, select the `Restore Snapshot` option from the Action menu. This will restore the encrypted snapshot to a new database instance. 10. On the Restore DB Instance page, enter a unique name for the new database instance in the DB Instance Identifier field. 11. Review the instance configuration details and click `Restore DB Instance`. 12. As the new instance provisioning process is completed, you can update the application configuration to refer to the endpoint of the new encrypted database instance. Once the database endpoint is changed at the application level, you can remove the unencrypted instance. **From Command Line:** 1. Run the `describe-db-instances` command to list the names of all RDS database instances in the selected AWS region. The command output should return database instance identifiers: ``` aws rds describe-db-instances --region --query 'DBInstances[*].DBInstanceIdentifier' ``` 2. Run the `create-db-snapshot` command to create a snapshot for a selected database instance. The command output will return the `new snapshot` with name DB Snapshot Name: ``` aws rds create-db-snapshot --region --db-snapshot-identifier --db-instance-identifier ``` 3. Now run the `list-aliases` command to list the KMS key aliases available in a specified region. The command output should return each `key alias currently available`. For our RDS encryption activation process, locate the ID of the AWS default KMS key: ``` aws kms list-aliases --region ``` 4. Run the `copy-db-snapshot` command using the default KMS key ID for the RDS instances returned earlier to create an encrypted copy of the database instance snapshot. The command output will return the `encrypted instance snapshot configuration`: ``` aws rds copy-db-snapshot --region --source-db-snapshot-identifier --target-db-snapshot-identifier --copy-tags --kms-key-id ``` 5. Run the `restore-db-instance-from-db-snapshot` command to restore the encrypted snapshot created in the previous step to a new database instance. If successful, the command output should return the configuration of the new encrypted database instance: ``` aws rds restore-db-instance-from-db-snapshot --region --db-instance-identifier --db-snapshot-identifier ``` 6. Run the `describe-db-instances` command to list all RDS database names available in the selected AWS region. The output will return the database instance identifier names. Select the encrypted database name that we just created, `db-name-encrypted`: ``` aws rds describe-db-instances --region --query 'DBInstances[*].DBInstanceIdentifier' ``` 7. Run the `describe-db-instances` command again using the RDS instance identifier returned earlier to determine if the selected database instance is encrypted. The command output should indicate that the encryption status is `True`: ``` aws rds describe-db-instances --region --db-instance-identifier --query 'DBInstances[*].StorageEncrypted' ```", + "AuditProcedure": "**From Console:** 1. Login to the AWS Management Console and open the RDS dashboard at https://console.aws.amazon.com/rds/. 2. In the navigation pane, under RDS dashboard, click `Databases`. 3. Select the RDS instance that you want to examine. 4. Click `Instance Name` to see details, then select the `Configuration` tab. 5. Under Configuration Details, in the Storage pane, search for the `Encryption Enabled` status. 6. If the current status is set to `Disabled`, encryption is not enabled for the selected RDS database instance. 7. Repeat steps 2 to 6 to verify the encryption status of other RDS instances in the same region. 8. Change the region from the top of the navigation bar, and repeat the audit steps for other regions. **From Command Line:** 1. Run the `describe-db-instances` command to list all the RDS database instance names available in the selected AWS region. The output will return each database instance identifier (name): ``` aws rds describe-db-instances --region --query 'DBInstances[*].DBInstanceIdentifier' ``` 2. Run the `describe-db-instances` command again, using an RDS instance identifier returned from step 1, to determine if the selected database instance is encrypted. The output should return the encryption status `True` or `False`: ``` aws rds describe-db-instances --region --db-instance-identifier --query 'DBInstances[*].StorageEncrypted' ``` 3. If the StorageEncrypted parameter value is `False`, encryption is not enabled for the selected RDS database instance. 4. Repeat steps 1 to 3 to audit each RDS instance, and change the region to verify RDS instances in other regions.", + "AdditionalInformation": "", + "References": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html:https://aws.amazon.com/blogs/database/selecting-the-right-encryption-options-for-amazon-rds-and-amazon-aurora-database-engines/#:~:text=With%20RDS%2Dencrypted%20resources%2C%20data,transparent%20to%20your%20database%20engine.:https://aws.amazon.com/rds/features/security/", + "DefaultValue": "" + } + ] + }, + { + "Id": "2.2.2", + "Description": "Ensure the Auto Minor Version Upgrade feature is enabled for RDS instances", + "Checks": [ + "rds_instance_minor_version_upgrade_enabled" + ], + "Attributes": [ + { + "Section": "2 Storage", + "SubSection": "2.2 Relational Database Service (RDS)", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled to automatically receive minor engine upgrades during the specified maintenance window. This way, RDS instances can obtain new features, bug fixes, and security patches for their database engines.", + "RationaleStatement": "AWS RDS will occasionally deprecate minor engine versions and provide new ones for upgrades. When the last version number within a release is replaced, the changed version is considered minor. With the Auto Minor Version Upgrade feature enabled, version upgrades will occur automatically during the specified maintenance window, allowing your RDS instances to receive new features, bug fixes, and security patches for their database engines.", + "ImpactStatement": "", + "RemediationProcedure": "**From Console:** 1. Log in to the AWS management console and navigate to the RDS dashboard at https://console.aws.amazon.com/rds/. 2. In the left navigation panel, click `Databases`. 3. Select the RDS instance that you want to update. 4. Click on the `Modify` button located at the top right side. 5. On the `Modify DB Instance: ` page, In the `Maintenance` section, select `Auto minor version upgrade` and click the `Yes` radio button. 6. At the bottom of the page, click `Continue`, and check `Apply Immediately` to apply the changes immediately, or select `Apply during the next scheduled maintenance window` to avoid any downtime. 7. Review the changes and click `Modify DB Instance`. The instance status should change from available to modifying and back to available. Once the feature is enabled, the `Auto Minor Version Upgrade` status should change to `Yes`. **From Command Line:** 1. Run the `describe-db-instances` command to list all RDS database instance names available in the selected AWS region: ``` aws rds describe-db-instances --region --query 'DBInstances[*].DBInstanceIdentifier' ``` 2. The command output should return each database instance identifier. 3. Run the `modify-db-instance` command to modify the configuration of a selected RDS instance. This command will apply the changes immediately. Remove `--apply-immediately` to apply changes during the next scheduled maintenance window and avoid any downtime: ``` aws rds modify-db-instance --region --db-instance-identifier --auto-minor-version-upgrade --apply-immediately ``` 4. The command output should reveal the new configuration metadata for the RDS instance, including the `AutoMinorVersionUpgrade` parameter value. 5. Run the `describe-db-instances` command to check if the Auto Minor Version Upgrade feature has been successfully enabled: ``` aws rds describe-db-instances --region --db-instance-identifier --query 'DBInstances[*].AutoMinorVersionUpgrade' ``` 6. The command output should return the feature's current status set to `true`, indicating that the feature is `enabled`, and that the minor engine upgrades will be applied to the selected RDS instance.", + "AuditProcedure": "**From Console:** 1. Log in to the AWS management console and navigate to the RDS dashboard at https://console.aws.amazon.com/rds/. 2. In the left navigation panel, click `Databases`. 3. Select the RDS instance that you want to examine. 4. Click on the `Maintenance and backups` panel. 5. Under the `Maintenance` section, search for the Auto Minor Version Upgrade status. - If the current status is `Disabled`, it means that the feature is not enabled, and the minor engine upgrades released will not be applied to the selected RDS instance. **From Command Line:** 1. Run the `describe-db-instances` command to list all RDS database names available in the selected AWS region: ``` aws rds describe-db-instances --region --query 'DBInstances[*].DBInstanceIdentifier' ``` 2. The command output should return each database instance identifier. 3. Run the `describe-db-instances` command again using a RDS instance identifier returned earlier to determine the Auto Minor Version Upgrade status for the selected instance: ``` aws rds describe-db-instances --region --db-instance-identifier --query 'DBInstances[*].AutoMinorVersionUpgrade' ``` 4. The command output should return the current status of the feature. If the current status is set to `true`, the feature is enabled and the minor engine upgrades will be applied to the selected RDS instance.", + "AdditionalInformation": "", + "References": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_RDS_Managing.html:https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Upgrading.html:https://aws.amazon.com/rds/faqs/", + "DefaultValue": "" + } + ] + }, + { + "Id": "2.2.3", + "Description": "Ensure that RDS instances are not publicly accessible", + "Checks": [ + "rds_instance_no_public_access" + ], + "Attributes": [ + { + "Section": "2 Storage", + "SubSection": "2.2 Relational Database Service (RDS)", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "Ensure and verify that the RDS database instances provisioned in your AWS account restrict unauthorized access in order to minimize security risks. To restrict access to any RDS database instance, you must disable the Publicly Accessible flag for the database and update the VPC security group associated with the instance.", + "RationaleStatement": "Ensure that no public-facing RDS database instances are provisioned in your AWS account, and restrict unauthorized access in order to minimize security risks. When the RDS instance allows unrestricted access (0.0.0.0/0), anyone and anything on the Internet can establish a connection to your database, which can increase the opportunity for malicious activities such as brute force attacks, PostgreSQL injections, or DoS/DDoS attacks.", + "ImpactStatement": "", + "RemediationProcedure": "**From Console:** 1. Log in to the AWS management console and navigate to the RDS dashboard at https://console.aws.amazon.com/rds/. 2. Under the navigation panel, on the RDS dashboard, click `Databases`. 3. Select the RDS instance that you want to update. 4. Click `Modify` from the dashboard top menu. 5. On the Modify DB Instance panel, under the `Connectivity` section, click on `Additional connectivity configuration` and update the value for `Publicly Accessible` to `Not publicly accessible` to restrict public access. 6. Follow the below steps to update subnet configurations: - Select the `Connectivity and security` tab, and click the VPC attribute value inside the `Networking` section. - Select the `Details` tab from the VPC dashboard's bottom panel and click the Route table configuration attribute value. - On the Route table details page, select the Routes tab from the dashboard's bottom panel and click `Edit routes`. - On the Edit routes page, update the Destination of Target which is set to `igw-xxxxx` and click `Save` routes. 7. On the Modify DB Instance panel, click `Continue`, and in the Scheduling of modifications section, perform one of the following actions based on your requirements: - Select `Apply during the next scheduled maintenance window` to apply the changes automatically during the next scheduled maintenance window. - Select `Apply immediately` to apply the changes right away. With this option, any pending modifications will be asynchronously applied as soon as possible, regardless of the maintenance window setting for this RDS database instance. Note that any changes available in the pending modifications queue are also applied. If any of the pending modifications require downtime, choosing this option can cause unexpected downtime for the application. 8. Repeat steps 3-7 for each RDS instance in the current region. 9. Change the AWS region from the navigation bar to repeat the process for other regions. **From Command Line:** 1. Run the `describe-db-instances` command to list all available RDS database identifiers in the selected AWS region: ``` aws rds describe-db-instances --region --query 'DBInstances[*].DBInstanceIdentifier' ``` 2. The command output should return each database instance identifier. 3. Run the `modify-db-instance` command to modify the configuration of a selected RDS instance, disabling the `Publicly Accessible` flag for that instance. This command uses the `apply-immediately` flag. If you want to avoid any downtime, the `--no-apply-immediately` flag can be used: ``` aws rds modify-db-instance --region --db-instance-identifier --no-publicly-accessible --apply-immediately ``` 4. The command output should reveal the `PubliclyAccessible` configuration under pending values, to be applied at the specified time. 5. Updating the Internet Gateway destination via the AWS CLI is not currently supported. To update information about the Internet Gateway, please use the AWS Console procedure. 6. Repeat steps 1-5 for each RDS instance provisioned in the current region. 7. Change the AWS region by using the --region filter to repeat the process for other regions.", + "AuditProcedure": "**From Console:** 1. Log in to the AWS management console and navigate to the RDS dashboard at https://console.aws.amazon.com/rds/. 2. Under the navigation panel, on the RDS dashboard, click `Databases`. 3. Select the RDS instance that you want to examine. 4. Click `Instance Name` from the dashboard, under `Connectivity and Security`. 5. In the `Security` section, check if the Publicly Accessible flag status is set to `Yes`. 6. Follow the steps below to check database subnet access: - In the `networking` section, click the subnet link under `Subnets`. - The link will redirect you to the VPC Subnets page. - Select the subnet listed on the page and click the `Route Table` tab from the dashboard bottom panel. - If the route table contains any entries with the destination CIDR block set to `0.0.0.0/0` and an `Internet Gateway` attached, the selected RDS database instance was provisioned inside a public subnet; therefore, it is not running within a logically isolated environment and can be accessed from the Internet. 7. Repeat steps 3-6 to determine the configuration of other RDS database instances provisioned in the current region. 8. Change the AWS region from the navigation bar and repeat the audit process for other regions. **From Command Line:** 1. Run the `describe-db-instances` command to list all available RDS database names in the selected AWS region: ``` aws rds describe-db-instances --region --query 'DBInstances[*].DBInstanceIdentifier' ``` 2. The command output should return each database instance `identifier`. 3. Run the `describe-db-instances` command again, using the `PubliclyAccessible` parameter as a query filter to reveal the status of the database instance's Publicly Accessible flag: ``` aws rds describe-db-instances --region --db-instance-identifier --query 'DBInstances[*].PubliclyAccessible' ``` 4. Check the Publicly Accessible parameter status. If the Publicly Accessible flag is set to `Yes`, then the selected RDS database instance is publicly accessible and insecure. Follow the steps mentioned below to check database subnet access. 5. Run the `describe-db-instances` command again using the RDS database instance identifier that you want to check, along with the appropriate filtering to describe the VPC subnet(s) associated with the selected instance: ``` aws rds describe-db-instances --region --db-instance-identifier --query 'DBInstances[*].DBSubnetGroup.Subnets[]' ``` - The command output should list the subnets available in the selected database subnet group. 6. Run the `describe-route-tables` command using the ID of the subnet returned in the previous step to describe the routes of the VPC route table associated with the selected subnet: ``` aws ec2 describe-route-tables --region --filters Name=association.subnet-id,Values= --query 'RouteTables[*].Routes[]' ``` - If the command returns the route table associated with the database instance subnet ID, check the values of the `GatewayId` and `DestinationCidrBlock` attributes returned in the output. If the route table contains any entries with the `GatewayId` value set to `igw-xxxxxxxx` and the `DestinationCidrBlock` value set to `0.0.0.0/0`, the selected RDS database instance was provisioned within a public subnet. - Or, if the command returns empty results, the route table is implicitly associated with the subnet; therefore, the audit process continues with the next step. 7. Run the `describe-db-instances` command again using the RDS database instance identifier that you want to check, along with the appropriate filtering to describe the VPC ID associated with the selected instance: ``` aws rds describe-db-instances --region --db-instance-identifier --query 'DBInstances[*].DBSubnetGroup.VpcId' ``` - The command output should show the VPC ID in the selected database subnet group. 8. Now run the `describe-route-tables` command using the ID of the VPC returned in the previous step to describe the routes of the VPC's main route table that is implicitly associated with the selected subnet: ``` aws ec2 describe-route-tables --region --filters Name=vpc-id,Values= Name=association.main,Values=true --query 'RouteTables[*].Routes[]' ``` - The command output returns the VPC main route table implicitly associated with the database instance subnet ID. Check the values of the `GatewayId` and `DestinationCidrBlock` attributes returned in the output. If the route table contains any entries with the `GatewayId` value set to `igw-xxxxxxxx` and the `DestinationCidrBlock` value set to `0.0.0.0/0`, the selected RDS database instance was provisioned inside a public subnet; therefore, it is not running within a logically isolated environment and does not adhere to AWS security best practices.", + "AdditionalInformation": "", + "References": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.html:https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html:https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html:https://aws.amazon.com/rds/faqs/", + "DefaultValue": "" + } + ] + }, + { + "Id": "2.2.4", + "Description": "Ensure Multi-AZ deployments are used for enhanced availability in Amazon RDS", + "Checks": [ + "rds_cluster_multi_az", + "rds_instance_multi_az" + ], + "Attributes": [ + { + "Section": "2 Storage", + "SubSection": "2.2 Relational Database Service (RDS)", + "Profile": "Level 1", + "AssessmentStatus": "Manual", + "Description": "Amazon RDS offers Multi-AZ deployments that provide enhanced availability and durability for your databases, using synchronous replication to replicate data to a standby instance in a different Availability Zone (AZ). In the event of an infrastructure failure, Amazon RDS automatically fails over to the standby to minimize downtime and ensure business continuity.", + "RationaleStatement": "Database availability is crucial for maintaining service uptime, particularly for applications that are critical to the business. Implementing Multi-AZ deployments with Amazon RDS ensures that your databases are protected against unplanned outages due to hardware failures, network issues, or other disruptions. This configuration enhances both the availability and durability of your database, making it a highly recommended practice for production environments.", + "ImpactStatement": "Multi-AZ deployments may increase costs due to the additional resources required to maintain a standby instance; however, the benefits of increased availability and reduced risk of downtime outweigh these costs for critical applications.", + "RemediationProcedure": "**From Console:** 1. Login to the AWS Management Console and open the RDS dashboard at [AWS RDS Console](https://console.aws.amazon.com/rds/). 2. In the left navigation pane, click on `Databases`. 3. Select the database instance that needs Multi-AZ deployment to be enabled. 4. Click the `Modify` button at the top right. 5. Scroll down to the `Availability & Durability` section. 6. Under `Multi-AZ deployment`, select `Yes` to enable. 7. Review the changes and click `Continue`. 8. On the `Review` page, choose `Apply immediately` to make the change without waiting for the next maintenance window, or `Apply during the next scheduled maintenance window`. 9. Click `Modify DB Instance` to apply the changes. **From Command Line:** 1. Run the following command to modify the RDS instance and enable Multi-AZ: ``` aws rds modify-db-instance --region --db-instance-identifier --multi-az --apply-immediately ``` 2. Confirm that the Multi-AZ deployment is enabled by running the following command: ``` aws rds describe-db-instances --region --db-instance-identifier --query 'DBInstances[*].MultiAZ' ``` - The output should return `True`, indicating that Multi-AZ is enabled. 3. Repeat the procedure for other instances as necessary.", + "AuditProcedure": "**From Console:** 1. Login to the AWS Management Console and open the RDS dashboard at [AWS RDS Console](https://console.aws.amazon.com/rds/). 2. In the navigation pane, under `Databases`, select the RDS instance you want to examine. 3. Click the `Instance Name` to see details, then navigate to the `Configuration` tab. 4. Under the `Availability & Durability` section, check the `Multi-AZ` status. - If Multi-AZ deployment is enabled, it will display `Yes`. - If it is disabled, the status will display `No`. 5. Repeat steps 2-4 to verify the Multi-AZ status of other RDS instances in the same region. 6. Change the region from the top of the navigation bar and repeat the audit for other regions. **From Command Line:** 1. Run the following command to list all RDS instances in the selected AWS region: ``` aws rds describe-db-instances --region --query 'DBInstances[*].DBInstanceIdentifier' ``` 2. Run the following command using the instance identifier returned earlier to check the Multi-AZ status: ``` aws rds describe-db-instances --region --db-instance-identifier --query 'DBInstances[*].MultiAZ' ``` - If the output is `True`, Multi-AZ is enabled. - If the output is `False`, Multi-AZ is not enabled. 3. Repeat steps 1 and 2 to audit each RDS instance, and change regions to verify in other regions.", + "AdditionalInformation": "", + "References": "", + "DefaultValue": "" + } + ] + }, + { + "Id": "2.3.1", + "Description": "Ensure that encryption is enabled for EFS file systems", + "Checks": [ + "efs_encryption_at_rest_enabled" + ], + "Attributes": [ + { + "Section": "2 Storage", + "SubSection": "2.3 Elastic File System (EFS)", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "EFS data should be encrypted at rest using AWS KMS (Key Management Service).", + "RationaleStatement": "Data should be encrypted at rest to reduce the risk of a data breach via direct access to the storage device.", + "ImpactStatement": "", + "RemediationProcedure": "**It is important to note that EFS file system data-at-rest encryption must be turned on when creating the file system. If an EFS file system has been created without data-at-rest encryption enabled, then you must create another EFS file system with the correct configuration and transfer the data.** **Steps to create an EFS file system with data encrypted at rest:** **From Console:** 1. Login to the AWS Management Console and Navigate to the `Elastic File System (EFS)` dashboard. 2. Select `File Systems` from the left navigation panel. 3. Click the `Create File System` button from the dashboard top menu to start the file system setup process. 4. On the `Configure file system access` configuration page, perform the following actions: - Choose an appropriate VPC from the VPC dropdown list. - Within the `Create mount targets` section, check the boxes for all of the Availability Zones (AZs) within the selected VPC. These will be your mount targets. - Click `Next step` to continue. 5. Perform the following on the `Configure optional settings` page: - Create `tags` to describe your new file system. - Choose `performance mode` based on your requirements. - Check the `Enable encryption` box and choose `aws/elasticfilesystem` from the `Select KMS master key` dropdown list to enable encryption for the new file system, using the default master key provided and managed by AWS KMS. - Click `Next step` to continue. 6. Review the file system configuration details on the `review and create` page and then click `Create File System` to create your new AWS EFS file system. 7. Copy the data from the old unencrypted EFS file system onto the newly created encrypted file system. 8. Remove the unencrypted file system as soon as your data migration to the newly created encrypted file system is completed. 9. Change the AWS region from the navigation bar and repeat the entire process for the other AWS regions. **From CLI:** 1. Run the `describe-file-systems` command to view the configuration information for the selected unencrypted file system identified in the Audit steps: ``` aws efs describe-file-systems --region --file-system-id ``` 2. The command output should return the configuration information. 3. To provision a new AWS EFS file system, you need to generate a universally unique identifier (UUID) to create the token required by the `create-file-system` command. To create the required token, you can use a randomly generated UUID from https://www.uuidgenerator.net. 4. Run the `create-file-system` command using the unique token created at the previous step: ``` aws efs create-file-system --region --creation-token --performance-mode generalPurpose --encrypted ``` 5. The command output should return the new file system configuration metadata. 6. Run the `create-mount-target` command using the EFS file system ID returned from step 4 as the identifier and the ID of the Availability Zone (AZ) that will represent the mount target: ``` aws efs create-mount-target --region --file-system-id --subnet-id ``` 7. The command output should return the new mount target metadata. 8. Now you can mount your file system from an EC2 instance. 9. Copy the data from the old unencrypted EFS file system to the newly created encrypted file system. 10. Remove the unencrypted file system as soon as your data migration to the newly created encrypted file system is completed: ``` aws efs delete-file-system --region --file-system-id ``` 11. Change the AWS region by updating the --region and repeat the entire process for the other AWS regions.", + "AuditProcedure": "**From Console:** 1. Login to the AWS Management Console and Navigate to the Elastic File System (EFS) dashboard. 2. Select `File Systems` from the left navigation panel. 3. Each item on the list has a visible Encrypted field that displays data at rest encryption status. 4. Validate that this field reads `Encrypted` for all EFS file systems in all AWS regions. **From CLI:** 1. Run the `describe-file-systems` command using custom query filters to list the identifiers of all AWS EFS file systems currently available within the selected region: ``` aws efs describe-file-systems --region --output table --query 'FileSystems[*].FileSystemId' ``` 2. The command output should return a table with the requested file system IDs. 3. Run the `describe-file-systems` command using the ID of the file system that you want to examine as `file-system-id` and the necessary query filters: ``` aws efs describe-file-systems --region --file-system-id --query 'FileSystems[*].Encrypted' ``` 4. The command output should return the file system encryption status as `true` or `false`. If the returned value is `false`, the selected AWS EFS file system is not encrypted and if the returned value is `true`, the selected AWS EFS file system is encrypted.", + "AdditionalInformation": "", + "References": "https://docs.aws.amazon.com/efs/latest/ug/encryption-at-rest.html:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/efs/index.html#efs", + "DefaultValue": "EFS file system data is encrypted at rest by default when creating a file system through the Console. However, encryption at rest is not enabled by default when creating a new file system using the AWS CLI, API, or SDKs." + } + ] + }, + { + "Id": "3.1", + "Description": "Ensure CloudTrail is enabled in all regions", + "Checks": [ + "cloudtrail_multi_region_enabled" + ], + "Attributes": [ + { + "Section": "3 Logging", + "Profile": "Level 1", + "AssessmentStatus": "Manual", + "Description": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).", + "RationaleStatement": "The AWS API call history produced by CloudTrail enables security analysis, resource change tracking, and compliance auditing. Additionally, - ensuring that a multi-region trail exists will help detect unexpected activity occurring in otherwise unused regions - ensuring that a multi-region trail exists will ensure that `Global Service Logging` is enabled for a trail by default to capture recordings of events generated on AWS global services - for a multi-region trail, ensuring that management events are configured for all types of Read/Writes ensures the recording of management operations that are performed on all resources in an AWS account", + "ImpactStatement": "S3 lifecycle features can be used to manage the accumulation and management of logs over time. See the following AWS resource for more information on these features: 1. https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html", + "RemediationProcedure": "Perform the following to enable global (Multi-region) CloudTrail logging: **From Console:** 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/cloudtrail](https://console.aws.amazon.com/cloudtrail). 2. Click on `Trails` in the left navigation pane. 3. Click `Get Started Now` if it is presented, then: - Click `Add new trail`. - Enter a trail name in the `Trail name` box. - A trail created in the console is a multi-region trail by default. - Specify an S3 bucket name in the `S3 bucket` box. - Specify the AWS KMS alias under the `Log file SSE-KMS encryption` section, or create a new key. - Click `Next`. 4. Ensure the `Management events` check box is selected. 5. Ensure both `Read` and `Write` are checked under API activity. 6. Click `Next`. 7. Review your trail settings and click `Create trail`. **From Command Line:** Create a multi-region trail: ``` aws cloudtrail create-trail --name --bucket-name --is-multi-region-trail ``` Enable multi-region on an existing trail: ``` aws cloudtrail update-trail --name --is-multi-region-trail ``` **Note:** Creating a CloudTrail trail via the CLI without providing any overriding options configures all `read` and `write` `Management Events` to be logged by default.", + "AuditProcedure": "Perform the following to determine if CloudTrail is enabled for all regions: **From Console:** 1. Sign in to the AWS Management Console and open the CloudTrail console at [https://console.aws.amazon.com/cloudtrail](https://console.aws.amazon.com/cloudtrail) 2. Click on `Trails` in the left navigation pane - You will be presented with a list of trails across all regions 3. Ensure that at least one Trail has `Yes` specified in the `Multi-region trail` column 4. Click on a trail via the link in the `Name` column 5. Ensure `Logging` is set to `ON` 6. Ensure `Multi-region trail` is set to `Yes` 7. In the section `Management Events`, ensure that `API activity` set to `ALL` **From Command Line:** 1. List all trails: ``` aws cloudtrail describe-trails ``` 2. Ensure `IsMultiRegionTrail` is set to `true`: ``` aws cloudtrail get-trail-status --name ``` 3. Ensure `IsLogging` is set to `true`: ``` aws cloudtrail get-event-selectors --trail-name ``` 4. Ensure there is at least one `fieldSelector` for a trail that equals `Management`: - This should NOT output any results for Field: readOnly. If either `true` or `false` is returned, one of the checkboxes (`read` or `write`) is not selected. Example of correct output: ``` TrailARN: , AdvancedEventSelectors: [ { Name: Management events selector, FieldSelectors: [ { Field: eventCategory, Equals: [ Management ] ```", + "AdditionalInformation": "", + "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-concepts.html#cloudtrail-concepts-management-events:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-and-data-events-with-cloudtrail.html?icmpid=docs_cloudtrail_console#logging-management-events:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-supported-services.html#cloud-trail-supported-services-data-events", + "DefaultValue": "Not Enabled" + } + ] + }, + { + "Id": "3.2", + "Description": "Ensure CloudTrail log file validation is enabled", + "Checks": [ + "cloudtrail_log_file_validation_enabled" + ], + "Attributes": [ + { + "Section": "3 Logging", + "Profile": "Level 2", + "AssessmentStatus": "Automated", + "Description": "CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or remained unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled for all CloudTrails.", + "RationaleStatement": "Enabling log file validation will provide additional integrity checks for CloudTrail logs.", + "ImpactStatement": "", + "RemediationProcedure": "Perform the following to enable log file validation on a given trail: **From Console:** 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/cloudtrail](https://console.aws.amazon.com/cloudtrail). 2. Click on `Trails` in the left navigation pane. 3. Click on the target trail. 4. Within the `General details` section, click `edit`. 5. Under `Advanced settings`, check the `enable` box under `Log file validation`. 6. Click `Save changes`. **From Command Line:** Enable log file validation on a trail: ``` aws cloudtrail update-trail --name --enable-log-file-validation ``` Note that periodic validation of logs using these digests can be carried out by running the following command: ``` aws cloudtrail validate-logs --trail-arn --start-time --end-time ```", + "AuditProcedure": "Perform the following on each trail to determine if log file validation is enabled: **From Console:** 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/cloudtrail](https://console.aws.amazon.com/cloudtrail). 2. Click on `Trails` in the left navigation pane. 3. For every trail: - Click on a trail via the link in the `Name` column. - Under the `General details` section, ensure `Log file validation` is set to `Enabled`. **From Command Line:** List all trails: ``` aws cloudtrail describe-trails ``` Ensure `LogFileValidationEnabled` is set to `true` for each trail.", + "AdditionalInformation": "", + "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-enabling.html", + "DefaultValue": "Not Enabled" + } + ] + }, + { + "Id": "3.3", + "Description": "Ensure AWS Config is enabled in all regions", + "Checks": [ + "config_recorder_all_regions_enabled" + ], + "Attributes": [ + { + "Section": "3 Logging", + "Profile": "Level 2", + "AssessmentStatus": "Automated", + "Description": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration items (AWS resources), relationships between configuration items (AWS resources), and any configuration changes between resources. It is recommended that AWS Config be enabled in all regions.", + "RationaleStatement": "The AWS configuration item history captured by AWS Config enables security analysis, resource change tracking, and compliance auditing.", + "ImpactStatement": "Enabling AWS Config in all regions provides comprehensive visibility into resource configurations, enhancing security and compliance monitoring. However, this may incur additional costs and require proper configuration management.", + "RemediationProcedure": "To implement AWS Config configuration: **From Console:** 1. Select the region you want to focus on in the top right of the console. 2. Click `Services`. 3. Click `Config`. 4. If a Config Recorder is enabled in this region, navigate to the Settings page from the navigation menu on the left-hand side. If a Config Recorder is not yet enabled in this region, select Get Started. 5. Select Record all resources supported in this region. 6. Choose to include global resources (IAM resources). 7. Specify an S3 bucket in the same account or in another managed AWS account. 8. Create an SNS Topic from the same AWS account or another managed AWS account. **From Command Line:** 1. Ensure there is an appropriate S3 bucket, SNS topic, and IAM role per the [AWS Config Service prerequisites](http://docs.aws.amazon.com/config/latest/developerguide/gs-cli-prereq.html). 2. Run this command to create a new configuration recorder: ``` aws configservice put-configuration-recorder --configuration-recorder name=,roleARN=arn:aws:iam:::role/ --recording-group allSupported=true,includeGlobalResourceTypes=true ``` 3. Create a delivery channel configuration file locally which specifies the channel attributes, populated from the prerequisites set up previously: ``` { name: , s3BucketName: , snsTopicARN: arn:aws:sns:::, configSnapshotDeliveryProperties: { deliveryFrequency: Twelve_Hours } } ``` 4. Run this command to create a new delivery channel, referencing the json configuration file made in the previous step: ``` aws configservice put-delivery-channel --delivery-channel file://.json ``` 5. Start the configuration recorder by running the following command: ``` aws configservice start-configuration-recorder --configuration-recorder-name ```", + "AuditProcedure": "Process to evaluate AWS Config configuration per region: **From Console:** 1. Sign in to the AWS Management Console and open the AWS Config console at [https://console.aws.amazon.com/config/](https://console.aws.amazon.com/config/). 1. On the top right of the console select the target region. 1. If a Config Recorder is enabled in this region, you should navigate to the Settings page from the navigation menu on the left-hand side. If a Config Recorder is not yet enabled in this region, proceed to the remediation steps. 1. Ensure Record all resources supported in this region is checked. 1. Ensure Include global resources (e.g., AWS IAM resources) is checked, unless it is enabled in another region (this is only required in one region). 1. Ensure the correct S3 bucket has been defined. 1. Ensure the correct SNS topic has been defined. 1. Repeat steps 2 to 7 for each region. **From Command Line:** 1. Run this command to show all AWS Config Recorders and their properties: ``` aws configservice describe-configuration-recorders ``` 2. Evaluate the output to ensure that all recorders have a `recordingGroup` object which includes `allSupported: true`. Additionally, ensure that at least one recorder has `includeGlobalResourceTypes: true`. **Note:** There is one more parameter, ResourceTypes, in the recordingGroup object. We don't need to check it, as whenever we set allSupported to true, AWS enforces the resource types to be empty (ResourceTypes: []). Sample output: ``` { ConfigurationRecorders: [ { recordingGroup: { allSupported: true, resourceTypes: [], includeGlobalResourceTypes: true }, roleARN: arn:aws:iam:::role/service-role/, name: default } ] } ``` 3. Run this command to show the status for all AWS Config Recorders: ``` aws configservice describe-configuration-recorder-status ``` 4. In the output, find recorders with `name` key matching the recorders that were evaluated in step 2. Ensure that they include `recording: true` and `lastStatus: SUCCESS`.", + "AdditionalInformation": "", + "References": "https://awscli.amazonaws.com/v2/documentation/api/latest/reference/configservice/describe-configuration-recorder-status.html:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/configservice/describe-configuration-recorders.html:https://docs.aws.amazon.com/config/latest/developerguide/gs-cli-prereq.html", + "DefaultValue": "" + } + ] + }, + { + "Id": "3.4", + "Description": "Ensure that server access logging is enabled on the CloudTrail S3 bucket", + "Checks": [ + "cloudtrail_logs_s3_bucket_access_logging_enabled" + ], + "Attributes": [ + { + "Section": "3 Logging", + "Profile": "Level 1", + "AssessmentStatus": "Manual", + "Description": "Server access logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that server access logging be enabled on the CloudTrail S3 bucket.", + "RationaleStatement": "By enabling server access logging on target S3 buckets, it is possible to capture all events that may affect objects within any target bucket. Configuring the logs to be placed in a separate bucket allows access to log information that can be useful in security and incident response workflows.", + "ImpactStatement": "", + "RemediationProcedure": "Perform the following to enable server access logging: **From Console:** 1. Sign in to the AWS Management Console and open the S3 console at [https://console.aws.amazon.com/s3](https://console.aws.amazon.com/s3). 2. Under `All Buckets` click on the target S3 bucket. 3. Click on `Properties` in the top right of the console. 4. Under `Bucket: `, click `Logging`. 5. Configure bucket logging: - Check the `Enabled` box. - Select a Target Bucket from the list. - Enter a Target Prefix. 6. Click `Save`. **From Command Line:** 1. Get the name of the S3 bucket that CloudTrail is logging to: ``` aws cloudtrail describe-trails --region --query trailList[*].S3BucketName ``` 2. Copy and add the target bucket name at ``, the prefix for the log file at ``, and optionally add an email address in the following template, then save it as `.json`: ``` { LoggingEnabled: { TargetBucket: , TargetPrefix: , TargetGrants: [ { Grantee: { Type: AmazonCustomerByEmail, EmailAddress: }, Permission: FULL_CONTROL } ] } } ``` 3. Run the `put-bucket-logging` command with bucket name and `.json` as input; for more information, refer to [put-bucket-logging](https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-logging.html): ``` aws s3api put-bucket-logging --bucket --bucket-logging-status file://.json ```", + "AuditProcedure": "Perform the following ensure that the CloudTrail S3 bucket has access logging is enabled: **From Console:** 1. Go to the Amazon CloudTrail console at [https://console.aws.amazon.com/cloudtrail/home](https://console.aws.amazon.com/cloudtrail/home). 2. In the API activity history pane on the left, click `Trails`. 3. In the Trails pane, note the bucket names in the S3 bucket column. 4. Sign in to the AWS Management Console and open the S3 console at [https://console.aws.amazon.com/s3](https://console.aws.amazon.com/s3). 5. Under `All Buckets` click on a target S3 bucket. 6. Click on `Properties` in the top right of the console. 7. Under `Bucket: `, click `Logging`. 8. Ensure `Enabled` is checked. **From Command Line:** 1. Get the name of the S3 bucket that CloudTrail is logging to: ``` aws cloudtrail describe-trails --query 'trailList[*].S3BucketName' ``` 2. Ensure logging is enabled on the bucket: ``` aws s3api get-bucket-logging --bucket ``` Ensure the command does not return an empty output. Sample output for a bucket with logging enabled: ``` { LoggingEnabled: { TargetPrefix: , TargetBucket: } } ```", + "AdditionalInformation": "", + "References": "https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerLogs.html:https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html", + "DefaultValue": "Logging is disabled." + } + ] + }, + { + "Id": "3.5", + "Description": "Ensure CloudTrail logs are encrypted at rest using KMS CMKs", + "Checks": [ + "cloudtrail_kms_encryption_enabled" + ], + "Attributes": [ + { + "Section": "3 Logging", + "Profile": "Level 2", + "AssessmentStatus": "Automated", + "Description": "AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer-created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.", + "RationaleStatement": "Configuring CloudTrail to use SSE-KMS provides additional confidentiality controls on log data, as a given user must have S3 read permission on the corresponding log bucket and must be granted decrypt permission by the CMK policy.", + "ImpactStatement": "Customer-created keys incur an additional cost. See https://aws.amazon.com/kms/pricing/ for more information.", + "RemediationProcedure": "Perform the following to configure CloudTrail to use SSE-KMS: **From Console:** 1. Sign in to the AWS Management Console and open the CloudTrail console at [https://console.aws.amazon.com/cloudtrail](https://console.aws.amazon.com/cloudtrail). 2. In the left navigation pane, choose `Trails`. 3. Click on a trail. 4. Under the `S3` section, click the edit button (pencil icon). 5. Click `Advanced`. 6. Select an existing CMK from the `KMS key Id` drop-down menu. - **Note:** Ensure the CMK is located in the same region as the S3 bucket. - **Note:** You will need to apply a KMS key policy on the selected CMK in order for CloudTrail, as a service, to encrypt and decrypt log files using the CMK provided. View the AWS documentation for [editing the selected CMK Key policy](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-kms-key-policy-for-cloudtrail.html). 7. Click `Save`. 8. You will see a notification message stating that you need to have decryption permissions on the specified KMS key to decrypt log files. 9. Click `Yes`. **From Command Line:** Run the following command to specify a KMS key ID to use with a trail: ``` aws cloudtrail update-trail --name --kms-id ``` Run the following command to attach a key policy to a specified KMS key: ``` aws kms put-key-policy --key-id --policy ```", + "AuditProcedure": "Perform the following to determine if CloudTrail is configured to use SSE-KMS: **From Console:** 1. Sign in to the AWS Management Console and open the CloudTrail console at [https://console.aws.amazon.com/cloudtrail](https://console.aws.amazon.com/cloudtrail). 2. In the left navigation pane, choose `Trails`. 3. Select a trail. 4. In the `General details` section, select `Edit` to edit the trail configuration. 5. Ensure the box at `Log file SSE-KMS encryption` is checked and that a valid `AWS KMS alias` of a KMS key is entered in the respective text box. **From Command Line:** 1. Run the following command: ``` aws cloudtrail describe-trails ``` 2. For each trail listed, SSE-KMS is enabled if the trail has a `KmsKeyId` property defined.", + "AdditionalInformation": "Three statements that need to be added to the CMK policy: 1\\. Enable CloudTrail to describe CMK properties: ``` 
{  Sid: Allow CloudTrail access,  Effect: Allow,  Principal: {  Service: cloudtrail.amazonaws.com  },  Action: kms:DescribeKey,  Resource: * } ``` 2\\. Granting encrypt permissions: ``` 
{  Sid: Allow CloudTrail to encrypt logs,  Effect: Allow,  Principal: {  Service: cloudtrail.amazonaws.com  },  Action: kms:GenerateDataKey*,  Resource: *,  Condition: {  StringLike: {  kms:EncryptionContext:aws:cloudtrail:arn: [  arn:aws:cloudtrail:*:aws-account-id:trail/*  ]  }  } } ``` 3\\. Granting decrypt permissions: ``` 
{  Sid: Enable CloudTrail log decrypt permissions,  Effect: Allow,  Principal: {  AWS: arn:aws:iam::aws-account-id:user/username  },  Action: kms:Decrypt,  Resource: *,  Condition: {  Null: {  kms:EncryptionContext:aws:cloudtrail:arn: false  }  } } ```",
+          "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html:https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudtrail/update-trail.html:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/kms/put-key-policy.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "3.6",
+      "Description": "Ensure rotation for customer-created symmetric CMKs is enabled",
+      "Checks": [
+        "kms_cmk_rotation_enabled"
+      ],
+      "Attributes": [
+        {
+          "Section": "3 Logging",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Automated",
+          "Description": "AWS Key Management Service (KMS) allows customers to rotate the backing key, which is key material stored within the KMS that is tied to the key ID of the customer-created customer master key (CMK). The backing key is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can occur transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation cannot be enabled for any asymmetric CMK.",
+          "RationaleStatement": "Rotating encryption keys helps reduce the potential impact of a compromised key, as data encrypted with a new key cannot be accessed with a previous key that may have been exposed. Keys should be rotated every year or upon an event that could result in the compromise of that key.",
+          "ImpactStatement": "Creation, management, and storage of CMKs may require additional time from an administrator.",
+          "RemediationProcedure": "**From Console:** 1. Sign in to the AWS Management Console and open the KMS console at: [https://console.aws.amazon.com/kms](https://console.aws.amazon.com/kms). 2. In the left navigation pane, click `Customer-managed keys`. 3. Select a key with `Key spec = SYMMETRIC_DEFAULT` that does not have automatic rotation enabled. 4. Select the `Key rotation` tab. 5. Check the `Automatically rotate this KMS key every year` box. 6. Click `Save`. 7. Repeat steps 3–6 for all customer-managed CMKs that do not have automatic rotation enabled. **From Command Line:** 1. Run the following command to enable key rotation: ```  aws kms enable-key-rotation --key-id  ```",
+          "AuditProcedure": "**From Console:** 1. Sign in to the AWS Management Console and open the KMS console at: [https://console.aws.amazon.com/kms](https://console.aws.amazon.com/kms). 2. In the left navigation pane, click `Customer-managed keys`. 3. Select a customer-managed CMK where `Key spec = SYMMETRIC_DEFAULT`. 4. Select the `Key rotation` tab. 5. Ensure the `Automatically rotate this KMS key every year` box is checked. 6. Repeat steps 3–5 for all customer-managed CMKs where `Key spec = SYMMETRIC_DEFAULT`. **From Command Line:** 1. Run the following command to get a list of all keys and their associated `KeyIds`: ```  aws kms list-keys ``` 2. For each key, note the KeyId and run the following command: ``` describe-key --key-id  ``` 3. If the response contains `KeySpec = SYMMETRIC_DEFAULT`, run the following command: ```  aws kms get-key-rotation-status --key-id  ``` 4. Ensure `KeyRotationEnabled` is set to `true`. 5. Repeat steps 2–4 for all remaining CMKs.",
+          "AdditionalInformation": "",
+          "References": "https://aws.amazon.com/kms/pricing/:https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "3.7",
+      "Description": "Ensure VPC flow logging is enabled in all VPCs",
+      "Checks": [
+        "vpc_flow_logs_enabled"
+      ],
+      "Attributes": [
+        {
+          "Section": "3 Logging",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Automated",
+          "Description": "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet Rejects for VPCs.",
+          "RationaleStatement": "VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or gain insights during security workflows.",
+          "ImpactStatement": "By default, CloudWatch Logs will store logs indefinitely unless a specific retention period is defined for the log group. When choosing the number of days to retain, keep in mind that the average time it takes for an organization to realize they have been breached is 210 days (at the time of this writing). Since additional time is required to research a breach, a minimum retention policy of 365 days allows for detection and investigation. You may also wish to archive the logs to a cheaper storage service rather than simply deleting them. See the following AWS resource to manage CloudWatch Logs retention periods: 1. https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/SettingLogRetention.html",
+          "RemediationProcedure": "Perform the following to enable VPC Flow Logs: **From Console:** 1. Sign into the management console. 2. Select `Services`, then select `VPC`. 3. In the left navigation pane, select `Your VPCs`. 4. Select a VPC. 5. In the right pane, select the `Flow Logs` tab. 6. If no Flow Log exists, click `Create Flow Log`. 7. For Filter, select `Reject`. 8. Enter a `Role` and `Destination Log Group`. 9. Click `Create Log Flow`. 10. Click on `CloudWatch Logs Group`. **Note:** Setting the filter to Reject will dramatically reduce the accumulation of logging data for this recommendation and provide sufficient information for the purposes of breach detection, research, and remediation. However, during periods of least privilege security group engineering, setting the filter to All can be very helpful in discovering existing traffic flows required for the proper operation of an already running environment. **From Command Line:** 1. Create a policy document, name it `role_policy_document.json`, and paste the following content: ``` {  Version: 2012-10-17,  Statement: [  {  Sid: test,  Effect: Allow,  Principal: {  Service: ec2.amazonaws.com  },  Action: sts:AssumeRole  }  ] } ``` 2. Create another policy document, name it `iam_policy.json`, and paste the following content: ``` {  Version: 2012-10-17,  Statement: [  {  Effect: Allow,  Action:[  logs:CreateLogGroup,  logs:CreateLogStream,  logs:DescribeLogGroups,  logs:DescribeLogStreams,  logs:PutLogEvents,  logs:GetLogEvents,  logs:FilterLogEvents  ],  Resource: *  }  ] } ``` 3. Run the following command to create an IAM role: ``` aws iam create-role --role-name  --assume-role-policy-document file://role_policy_document.json  ``` 4. Run the following command to create an IAM policy: ``` aws iam create-policy --policy-name  --policy-document file://iam-policy.json ``` 5. Run the `attach-group-policy` command, using the IAM policy ARN returned from the previous step to attach the policy to the IAM role: ``` aws iam attach-group-policy --policy-arn arn:aws:iam:::policy/ --group-name  ``` - If the command succeeds, no output is returned. 6. Run the `describe-vpcs` command to get a list of VPCs in the selected region: ``` aws ec2 describe-vpcs --region  ``` - The command output should return a list of VPCs in the selected region. 7. Run the `create-flow-logs` command to create a flow log for a VPC: ``` aws ec2 create-flow-logs --resource-type VPC --resource-ids  --traffic-type REJECT --log-group-name  --deliver-logs-permission-arn  ``` 8. Repeat step 7 for other VPCs in the selected region. 9. Change the region by updating --region, and repeat the remediation procedure for each region.",
+          "AuditProcedure": "Perform the following to determine if VPC Flow logs are enabled: **From Console:** 1. Sign into the management console. 2. Select `Services`, then select `VPC`. 3. In the left navigation pane, select `Your VPCs`. 4. Select a VPC. 5. In the right pane, select the `Flow Logs` tab. 6. Ensure a Log Flow exists that has `Active` in the `Status` column. **From Command Line:** 1. Run the `describe-vpcs` command (OSX/Linux/UNIX) to list the VPC networks available in the current AWS region: ``` aws ec2 describe-vpcs --region  --query Vpcs[].VpcId ``` 2. The command output returns the `VpcId` of VPCs available in the selected region. 3. Run the `describe-flow-logs` command (OSX/Linux/UNIX) using the VPC ID to determine if the selected virtual network has the Flow Logs feature enabled: ``` aws ec2 describe-flow-logs --filter Name=resource-id,Values= ``` - If there are no Flow Logs created for the selected VPC, the command output will return an empty list `[]`. 4. Repeat step 3 for other VPCs in the same region. 5. Change the region by updating `--region`, and repeat steps 1-4 for each region.",
+          "AdditionalInformation": "",
+          "References": "https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/flow-logs.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "3.8",
+      "Description": "Ensure that object-level logging for write events is enabled for S3 buckets",
+      "Checks": [
+        "cloudtrail_s3_dataevents_write_enabled"
+      ],
+      "Attributes": [
+        {
+          "Section": "3 Logging",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Automated",
+          "Description": "S3 object-level API operations, such as GetObject, DeleteObject, and PutObject, are referred to as data events. By default, CloudTrail trails do not log data events, so it is recommended to enable object-level logging for S3 buckets.",
+          "RationaleStatement": "Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analyses, monitor specific patterns of user behavior in your AWS account, or take immediate actions on any object-level API activity within your S3 buckets using Amazon CloudWatch Events.",
+          "ImpactStatement": "Enabling logging for these object-level events may significantly increase the number of events logged and may incur additional costs.",
+          "RemediationProcedure": "**From Console:** 1. Login to the AWS Management Console and navigate to the S3 dashboard at `https://console.aws.amazon.com/s3/`. 2. In the left navigation panel, click `buckets`, and then click the name of the S3 bucket you want to examine. 3. Click the `Properties` tab to see the bucket configuration in detail. 4. In the `AWS CloudTrail data events` section, select the trail name for recording activity. You can choose an existing trail or create a new one by clicking the `Configure in CloudTrail` button or navigating to the [CloudTrail console](https://console.aws.amazon.com/cloudtrail/). 5. Once the trail is selected, select the `Data Events` check box. 6. Select `S3` from the `Data event type` drop-down. 7. Select `Log all events` from the `Log selector template` drop-down. 8. Repeat steps 2-7 to enable object-level logging of write events for other S3 buckets. **From Command Line:** 1. To enable `object-level` data events logging for S3 buckets within your AWS account, run the `put-event-selectors` command using the name of the trail that you want to reconfigure as identifier: ``` aws cloudtrail put-event-selectors --region  --trail-name  --event-selectors '[{ ReadWriteType: WriteOnly, IncludeManagementEvents:true, DataResources: [{ Type: AWS::S3::Object, Values: [arn:aws:s3:::/] }] }]' ``` 2. The command output will be `object-level` event trail configuration. 3. If you want to enable it for all buckets at once, change the Values parameter to `[arn:aws:s3]` in the previous command. 4. Repeat step 1 for each s3 bucket to update `object-level` logging of write events. 5. Change the AWS region by updating the `--region` command parameter, and perform the process for the other regions.",
+          "AuditProcedure": "**From Console:** 1. Login to the AWS Management Console and navigate to the CloudTrail dashboard at `https://console.aws.amazon.com/cloudtrail/`. 2. In the left panel, click `Trails`, and then click the name of the trail that you want to examine. 3. Review `General details`. 4. Confirm that `Multi-region trail` is set to `Yes`. 5. Scroll down to `Data events` and confirm the configuration: - If `advanced event selectors` is being used, it should read: ``` Data Events: S3 Log selector template Log all events ``` - If `basic event selectors` is being used, it should read: ``` Data events: S3 Bucket Name: All current and future S3 buckets Write: Enabled ``` 6. Repeat steps 2-5 to verify that each trail has multi-region enabled and is configured to log data events. If a trail does not have multi-region enabled and data event logging configured, refer to the remediation steps. **From Command Line:** 1. Run the `list-trails` command to list all trails: ``` aws cloudtrail list-trails ``` 2. The command output will be a list of trails: ``` TrailARN: arn:aws:cloudtrail:::trail/, Name: , HomeRegion:  ``` 3. Run the `get-trail` command to determine whether a trail is a multi-region trail: ``` aws cloudtrail get-trail --name  --region  ``` 4. The command output should include: `IsMultiRegionTrail: true`. 5. Run the `get-event-selectors` command, using the `Name` of the trail and the `region` returned in step 2, to determine if data event logging is configured: ``` aws cloudtrail get-event-selectors --region  --trail-name  --query EventSelectors[*].DataResources[] ``` 6. The command output should be an array that includes the S3 bucket defined for data event logging: ``` Type: AWS::S3::Object,  Values: [  arn:aws:s3 ``` 7. If the `get-event-selectors` command returns an empty array, data events are not included in the trail's logging configuration; therefore, object-level API operations performed on S3 buckets within your AWS account are not being recorded. 8. Repeat steps 1-7 to verify that each trail has multi-region enabled and is configured to log data events. If a trail does not have multi-region enabled and data event logging configured, refer to the remediation steps.",
+          "AdditionalInformation": "",
+          "References": "https://docs.aws.amazon.com/AmazonS3/latest/user-guide/enable-cloudtrail-events.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "3.9",
+      "Description": "Ensure that object-level logging for read events is enabled for S3 buckets",
+      "Checks": [
+        "cloudtrail_s3_dataevents_read_enabled"
+      ],
+      "Attributes": [
+        {
+          "Section": "3 Logging",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Automated",
+          "Description": "S3 object-level API operations, such as GetObject, DeleteObject, and PutObject, are referred to as data events. By default, CloudTrail trails do not log data events, so it is recommended to enable object-level logging for S3 buckets.",
+          "RationaleStatement": "Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analyses, monitor specific patterns of user behavior in your AWS account, or take immediate actions on any object-level API activity within your S3 buckets using Amazon CloudWatch Events.",
+          "ImpactStatement": "Enabling logging for these object-level events may significantly increase the number of events logged and may incur additional costs.",
+          "RemediationProcedure": "**From Console:** 1. Login to the AWS Management Console and navigate to S3 dashboard at `https://console.aws.amazon.com/s3/`. 2. In the left navigation panel, click `buckets` and then click the name of the S3 bucket that you want to examine. 3. Click the `Properties` tab to see the bucket configuration in detail. 4. In the `AWS Cloud Trail data events` section, select the trail name for recording activity. You can choose an existing trail or create a new one by clicking the `Configure in CloudTrail` button or navigating to the [CloudTrail console](https://console.aws.amazon.com/cloudtrail/). 5. Once the trail is selected, select the `Data Events` check box. 6. Select `S3` from the `Data event type` drop-down. 7. Select `Log all events` from the `Log selector template` drop-down. 8. Repeat steps 2-7 to enable object-level logging of read events for other S3 buckets. **From Command Line:** 1. To enable `object-level` data events logging for S3 buckets within your AWS account, run the `put-event-selectors` command using the name of the trail that you want to reconfigure as identifier: ``` aws cloudtrail put-event-selectors --region  --trail-name  --event-selectors '[{ ReadWriteType: ReadOnly, IncludeManagementEvents:true, DataResources: [{ Type: AWS::S3::Object, Values: [arn:aws:s3:::/] }] }]' ``` 2. The command output will be `object-level` event trail configuration. 3. If you want to enable it for all buckets at once, change the Values parameter to `[arn:aws:s3]` in the previous command. 4. Repeat step 1 for each s3 bucket to update `object-level` logging of read events. 5. Change the AWS region by updating the `--region` command parameter, and perform the process for the other regions.",
+          "AuditProcedure": "**From Console:** 1. Login to the AWS Management Console and navigate to the CloudTrail dashboard at `https://console.aws.amazon.com/cloudtrail/`. 2. In the left panel, click `Trails`, and then click the name of the trail that you want to examine. 3. Review `General details`. 4. Confirm that `Multi-region trail` is set to `Yes` 5. Scroll down to `Data events` 5. Scroll down to `Data events` and confirm the configuration: - If `advanced event selectors` is being used, it should read: ``` Data Events: S3 Log selector template Log all events ``` - If `basic event selectors` is being used, it should read: ``` Data events: S3 Bucket Name: All current and future S3 buckets Read: Enabled ``` 6. Repeat steps 2-5 to verify that each trail has multi-region enabled and is configured to log data events. If a trail does not have multi-region enabled and data event logging configured, refer to the remediation steps. **From Command Line:** 1. Run the `describe-trails` command to list all trail names: ``` aws cloudtrail describe-trails --region  --output table --query trailList[*].Name ``` 2. The command output will be table of the trail names. 3. Run the `get-event-selectors` command using the name of a trail returned at the previous step and custom query filters to determine if data event logging is configured: ``` aws cloudtrail get-event-selectors --region  --trail-name  --query EventSelectors[*].DataResources[] ``` 4. The command output should be an array that includes the S3 bucket defined for data event logging. 5. If the `get-event-selectors` command returns an empty array, data events are not included in the trail's logging configuration; therefore, object-level API operations performed on S3 buckets within your AWS account are not being recorded. 6. Repeat steps 1-5 to verify the configuration of each trail. 7. Change the AWS region by updating the `--region` command parameter, and perform the audit process for other regions.",
+          "AdditionalInformation": "",
+          "References": "https://docs.aws.amazon.com/AmazonS3/latest/user-guide/enable-cloudtrail-events.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.1",
+      "Description": "Ensure unauthorized API calls are monitored",
+      "Checks": [
+        "cloudwatch_log_metric_filter_unauthorized_api_calls"
+      ],
+      "Attributes": [
+        {
+          "Section": "4 Monitoring",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms.  It is recommended that a metric filter and alarm be established for unauthorized API calls.",
+          "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring unauthorized API calls will help reduce the time it takes to detect malicious activity and can alert you to potential security incidents.",
+          "ImpactStatement": "This alert may be triggered by normal read-only console activities that attempt to opportunistically gather optional information but gracefully fail if they lack the necessary permissions. If an excessive number of alerts are generated, then an organization may wish to consider adding read access to the limited IAM user permissions solely to reduce the number of alerts. In some cases, doing this may allow users to actually view some areas of the system; any additional access granted should be reviewed for alignment with the original limited IAM user intent.",
+          "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for unauthorized API calls and uses the `` taken from audit step 1:  ```  aws logs put-metric-filter --log-group-name  --filter-name  --metric-transformations metricName=unauthorized_api_calls_metric,metricNamespace=CISBenchmark,metricValue=1 --filter-pattern { ($.errorCode =*UnauthorizedOperation) || ($.errorCode =AccessDenied*) && ($.sourceIPAddress!=delivery.logs.amazonaws.com) && ($.eventName!=HeadBucket) }  ```  **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify:  ```  aws sns create-topic --name   ```  **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms.  **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2:  ```  aws sns subscribe --topic-arn  --protocol  --notification-endpoint   ```  **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2:  ```  aws cloudwatch put-metric-alarm --alarm-name unauthorized_api_calls_alarm --metric-name unauthorized_api_calls_metric --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace CISBenchmark --alarm-actions   ```",
+          "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`` - Note the `` within the value associated with CloudWatchLogsLogGroupArn  - Example: `arn:aws:logs:::log-group::*` - Ensure the identified multi-region CloudTrail trail is active:  - `aws cloudtrail get-trail-status --name `  - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events:  - `aws cloudtrail get-event-selectors --trail-name `  - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `` captured in step 1:  ```  aws logs describe-metric-filters --log-group-name   ``` 3. Ensure the output from the above command contains the following:  ```  filterPattern: { ($.errorCode =*UnauthorizedOperation) || ($.errorCode =AccessDenied*) && ($.sourceIPAddress!=delivery.logs.amazonaws.com) && ($.eventName!=HeadBucket) },  ``` 4. Note the `` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `` captured in step 4:  ```  aws cloudwatch describe-alarms --query MetricAlarms[?MetricName == ]  ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic:  ```  aws sns list-subscriptions-by-topic --topic-arn    ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN.  - Example of valid SubscriptionArn: `arn:aws:sns::::`",
+          "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+          "References": "https://aws.amazon.com/sns/:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.2",
+      "Description": "Ensure management console sign-in without MFA is monitored",
+      "Checks": [
+        "cloudwatch_log_metric_filter_sign_in_without_mfa"
+      ],
+      "Attributes": [
+        {
+          "Section": "4 Monitoring",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms.  It is recommended that a metric filter and alarm be established for console logins that are not protected by multi-factor authentication (MFA).",
+          "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring for single-factor console logins will increase visibility into accounts that are not protected by MFA. These type of accounts are more susceptible to compromise and unauthorized access.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for AWS Management Console sign-ins without MFA and uses the `` taken from audit step 1.  ```  aws logs put-metric-filter --log-group-name  --filter-name `` --metric-transformations metricName= ``,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventName = ConsoleLogin) && ($.additionalEventData.MFAUsed != Yes) }'  ```  Or, to reduce false positives in case Single Sign-On (SSO) is used in the organization:  ```  aws logs put-metric-filter --log-group-name  --filter-name `` --metric-transformations metricName= ``,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventName = ConsoleLogin) && ($.additionalEventData.MFAUsed != Yes) && ($.userIdentity.type = IAMUser) && ($.responseElements.ConsoleLogin = Success) }'  ```  **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify:  ```  aws sns create-topic --name   ```  **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms.  **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2:  ```  aws sns subscribe --topic-arn  --protocol  --notification-endpoint   ```  **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2:  ```  aws cloudwatch put-metric-alarm --alarm-name `` --metric-name `` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions   ```",
+          "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails:  ```  aws cloudtrail describe-trails  ``` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`` - Note the `` within the value associated with CloudWatchLogsLogGroupArn  - Example: `arn:aws:logs:::log-group::*` - Ensure the identified multi-region CloudTrail trail is active:  ```  aws cloudtrail get-trail-status --name   ```  - ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events:  ```  aws cloudtrail get-event-selectors --trail-name   ```  - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `` captured in step 1:  ```  aws logs describe-metric-filters --log-group-name   ``` 3. Ensure the output from the above command contains the following:  ```  filterPattern: { ($.eventName = ConsoleLogin) && ($.additionalEventData.MFAUsed != Yes) }  ```  Or, to reduce false positives in case Single Sign-On (SSO) is used in the organization:  ```  filterPattern: { ($.eventName = ConsoleLogin) && ($.additionalEventData.MFAUsed != Yes) && ($.userIdentity.type = IAMUser) && ($.responseElements.ConsoleLogin = Success) }  ``` 4. Note the `` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `` captured in step 4.  ```  aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName== ]'  ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic:  ```  aws sns list-subscriptions-by-topic --topic-arn    ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN.  - Example of valid SubscriptionArn: `arn:aws:sns::::`",
+          "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored Filter pattern set to `{ ($.eventName = ConsoleLogin) && ($.additionalEventData.MFAUsed != Yes) && ($.userIdentity.type = IAMUser) && ($.responseElements.ConsoleLogin = Success}`: - reduces false alarms raised when a user logs in via SSO",
+          "References": "https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/viewing_metrics_with_cloudwatch.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.3",
+      "Description": "Ensure usage of the 'root' account is monitored",
+      "Checks": [
+        "cloudwatch_log_metric_filter_root_usage"
+      ],
+      "Attributes": [
+        {
+          "Section": "4 Monitoring",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms.  It is recommended that a metric filter and alarm be established for 'root' login attempts to detect unauthorized use or attempts to use the root account.",
+          "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring 'root' account logins will provide visibility into the use of a fully privileged account and the opportunity to reduce its usage.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for 'root' account usage and uses the `` taken from audit step 1:  ```  aws logs put-metric-filter --log-group-name `` --filter-name `` --metric-transformations metricName= `` ,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ $.userIdentity.type = Root && $.userIdentity.invokedBy NOT EXISTS && $.eventType != AwsServiceEvent }'  ```  **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify:  ```  aws sns create-topic --name   ```  **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms.  **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2:  ```  aws sns subscribe --topic-arn  --protocol  --notification-endpoint   ```  **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2:  ```  aws cloudwatch put-metric-alarm --alarm-name `` --metric-name `` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions   ```",
+          "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails:  ```  aws cloudtrail describe-trails  ``` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`` - Note the `` within the value associated with CloudWatchLogsLogGroupArn  - Example: `arn:aws:logs:::log-group::*` - Ensure the identified multi-region CloudTrail trail is active:  ```  aws cloudtrail get-trail-status --name   ```  - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events:  ```  aws cloudtrail get-event-selectors --trail-name   ```  - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `` captured in step 1:  ```  aws logs describe-metric-filters --log-group-name   ``` 3. Ensure the output from the above command contains the following:  ```  filterPattern: { $.userIdentity.type = Root && $.userIdentity.invokedBy NOT EXISTS && $.eventType != AwsServiceEvent }  ``` 4. Note the `` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `` captured in step 4:  ```  aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==]'  ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic:  ```  aws sns list-subscriptions-by-topic --topic-arn    ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN.  - Example of valid SubscriptionArn: `arn:aws:sns::::`",
+          "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+          "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.4",
+      "Description": "Ensure IAM policy changes are monitored",
+      "Checks": [
+        "cloudwatch_log_metric_filter_policy_changes"
+      ],
+      "Attributes": [
+        {
+          "Section": "4 Monitoring",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes made to Identity and Access Management (IAM) policies.",
+          "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring changes to IAM policies will help ensure authentication and authorization controls remain intact.",
+          "ImpactStatement": "Monitoring these changes may result in a number of false positives, especially in larger environments. This alert may require more tuning than others to eliminate some of those erroneous notifications.",
+          "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for IAM policy changes and the `` taken from audit step 1:  ```  aws logs put-metric-filter --log-group-name `` --filter-name `` --metric-transformations metricName= ``,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}'  ```  **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify:  ```  aws sns create-topic --name   ```  **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms.  **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2:  ```  aws sns subscribe --topic-arn  --protocol  --notification-endpoint   ```  **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2:  ```  aws cloudwatch put-metric-alarm --alarm-name `` --metric-name `` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions   ```",
+          "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrails:  ```  aws cloudtrail describe-trails  ``` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`` - Note the `` within the value associated with CloudWatchLogsLogGroupArn  - Example: `arn:aws:logs:::log-group::*` - Ensure the identified multi-region CloudTrail trail is active:  ```  aws cloudtrail get-trail-status --name   ```  - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events:  ```  aws cloudtrail get-event-selectors --trail-name   ```  - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `` captured in step 1:  ```  aws logs describe-metric-filters --log-group-name   ``` 3. Ensure the output from the above command contains the following:  ```  filterPattern: {($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}  ``` 4. Note the `` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `` captured in step 4:  ```  aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==]'  ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic:  ```  aws sns list-subscriptions-by-topic --topic-arn    ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN.  - Example of valid SubscriptionArn: `arn:aws:sns::::`",
+          "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+          "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.5",
+      "Description": "Ensure CloudTrail configuration changes are monitored",
+      "Checks": [
+        "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled"
+      ],
+      "Attributes": [
+        {
+          "Section": "4 Monitoring",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms.  It is recommended that a metric filter and alarm be used to detect changes to CloudTrail's configurations.",
+          "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring changes to CloudTrail's configuration will help ensure sustained visibility into the activities performed in the AWS account.",
+          "ImpactStatement": "Ensuring that changes to CloudTrail configurations are monitored enhances security by maintaining the integrity of logging mechanisms. Automated monitoring can provide real-time alerts; however, it may require additional setup and resources to configure and manage these alerts effectively. These steps can be performed manually within a company's existing SIEM platform in cases where CloudTrail logs are monitored outside of the AWS monitoring tools in CloudWatch.",
+          "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for CloudTrail configuration changes and the `` taken from audit step 1:  ```  aws logs put-metric-filter --log-group-name  --filter-name  --metric-transformations metricName=,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName = StopLogging) }'  ```  **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify:  ```  aws sns create-topic --name   ```  **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms.  **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2:  ```  aws sns subscribe --topic-arn  --protocol  --notification-endpoint   ```  **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2:  ```  aws cloudwatch put-metric-alarm --alarm-name  --metric-name  --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions   ```",
+          "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`` - Note the `` within the value associated with CloudWatchLogsLogGroupArn  - Example: `arn:aws:logs:::log-group::*` - Ensure the identified multi-region CloudTrail trail is active:  - `aws cloudtrail get-trail-status --name `  - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events:  - `aws cloudtrail get-event-selectors --trail-name `  - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `` captured in step 1:  ```  aws logs describe-metric-filters --log-group-name   ``` 3. Ensure the output from the above command contains the following:  ```  filterPattern: { ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName = StopLogging) }  ``` 4. Note the `` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `` captured in step 4:  ```  aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==]'  ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic:  ```  aws sns list-subscriptions-by-topic --topic-arn    ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN.  - Example of valid SubscriptionArn: `arn:aws:sns::::`",
+          "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+          "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.6",
+      "Description": "Ensure AWS Management Console authentication failures are monitored",
+      "Checks": [
+        "cloudwatch_log_metric_filter_authentication_failures"
+      ],
+      "Attributes": [
+        {
+          "Section": "4 Monitoring",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms.  It is recommended that a metric filter and alarm be established for failed console authentication attempts.",
+          "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring failed console logins may decrease the lead time to detect an attempt to brute-force a credential, which may provide an indicator, such as the source IP address, that can be used in other event correlations.",
+          "ImpactStatement": "Monitoring for these failures may generate a large number of alerts, especially in larger environments.",
+          "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for AWS management Console login failures and uses the `` taken from audit step 1:  ```  aws logs put-metric-filter --log-group-name  --filter-name  --metric-transformations metricName=,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventName = ConsoleLogin) && ($.errorMessage = Failed authentication) }'  ```  **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify:  ```  aws sns create-topic --name   ```  **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms.  **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2:  ```  aws sns subscribe --topic-arn  --protocol  --notification-endpoint   ```  **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2:  ```  aws cloudwatch put-metric-alarm --alarm-name  --metric-name  --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions   ```",
+          "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`` - Note the `` within the value associated with CloudWatchLogsLogGroupArn  - Example: `arn:aws:logs:::log-group::*` - Ensure the identified multi-region CloudTrail trail is active:  - `aws cloudtrail get-trail-status --name `  - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events:  - `aws cloudtrail get-event-selectors --trail-name `  - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `` captured in step 1:  ```  aws logs describe-metric-filters --log-group-name   ``` 3. Ensure the output from the above command contains the following:  ```  filterPattern: { ($.eventName = ConsoleLogin) && ($.errorMessage = Failed authentication) }  ``` 4. Note the `` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `` captured in step 4:  ```  aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==]'  ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic:  ```  aws sns list-subscriptions-by-topic --topic-arn    ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN.  - Example of valid SubscriptionArn: `arn:aws:sns::::`",
+          "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+          "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.7",
+      "Description": "Ensure disabling or scheduled deletion of customer created CMKs is monitored",
+      "Checks": [
+        "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk"
+      ],
+      "Attributes": [
+        {
+          "Section": "4 Monitoring",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms.  It is recommended that a metric filter and alarm be established for customer-created CMKs that have changed state to disabled or are scheduled for deletion.",
+          "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Data encrypted with disabled or deleted keys will no longer be accessible. Changes in the state of a CMK should be monitored to ensure that the change is intentional.",
+          "ImpactStatement": "Creation, storage, and management of CMK may require additional labor compared to the use of AWS-managed keys.",
+          "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for CMKs that have been disabled or scheduled for deletion and uses the `` taken from audit step 1:  ```  aws logs put-metric-filter --log-group-name  --filter-name  --metric-transformations metricName=,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{($.eventSource = kms.amazonaws.com) && (($.eventName=DisableKey)||($.eventName=ScheduleKeyDeletion)) }'  ```  **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify:  ```  aws sns create-topic --name   ```  **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms.  **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2:  ```  aws sns subscribe --topic-arn  --protocol  --notification-endpoint   ```  **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2:  ```  aws cloudwatch put-metric-alarm --alarm-name  --metric-name  --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions   ```",
+          "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`` - Note the `` within the value associated with CloudWatchLogsLogGroupArn  - Example: `arn:aws:logs:::log-group::*` - Ensure the identified multi-region CloudTrail trail is active:  - `aws cloudtrail get-trail-status --name `  - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events:  - `aws cloudtrail get-event-selectors --trail-name `  - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `` captured in step 1:  ```  aws logs describe-metric-filters --log-group-name   ``` 3. Ensure the output from the above command contains the following:  ```  filterPattern: {($.eventSource = kms.amazonaws.com) && (($.eventName=DisableKey)||($.eventName=ScheduleKeyDeletion)) }  ``` 4. Note the `` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `` captured in step 4:  ```  aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==]'  ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic:  ```  aws sns list-subscriptions-by-topic --topic-arn    ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN.  - Example of valid SubscriptionArn: `arn:aws:sns::::`",
+          "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+          "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.8",
+      "Description": "Ensure S3 bucket policy changes are monitored",
+      "Checks": [
+        "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes"
+      ],
+      "Attributes": [
+        {
+          "Section": "4 Monitoring",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms.  It is recommended that a metric filter and alarm be established for changes to S3 bucket policies.",
+          "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring changes to S3 bucket policies may reduce the time it takes to detect and correct permissive policies on sensitive S3 buckets.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for changes to S3 bucket policies and uses the `` taken from audit step 1:  ```  aws logs put-metric-filter --log-group-name  --filter-name  --metric-transformations metricName=,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventSource = s3.amazonaws.com) && (($.eventName = PutBucketAcl) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }'  ```  **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify:  ```  aws sns create-topic --name   ```  **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms.  **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2:  ```  aws sns subscribe --topic-arn  --protocol  --notification-endpoint   ```  **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2:  ```  aws cloudwatch put-metric-alarm --alarm-name  --metric-name  --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions   ```",
+          "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`` - Note the `` within the value associated with CloudWatchLogsLogGroupArn  - Example: `arn:aws:logs:::log-group::*` - Ensure the identified multi-region CloudTrail trail is active:  - `aws cloudtrail get-trail-status --name `  - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events:  - `aws cloudtrail get-event-selectors --trail-name `  - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `` captured in step 1:  ```  aws logs describe-metric-filters --log-group-name   ``` 3. Ensure the output from the above command contains the following:  ```  filterPattern: { ($.eventSource = s3.amazonaws.com) && (($.eventName = PutBucketAcl) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }  ``` 4. Note the `` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `` captured in step 4:  ```  aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==]'  ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic:  ```  aws sns list-subscriptions-by-topic --topic-arn    ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN.  - Example of valid SubscriptionArn: `arn:aws:sns::::`",
+          "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+          "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.9",
+      "Description": "Ensure AWS Config configuration changes are monitored",
+      "Checks": [
+        "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled"
+      ],
+      "Attributes": [
+        {
+          "Section": "4 Monitoring",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms.  It is recommended that a metric filter and alarm be established for detecting changes to AWS Config's configurations.",
+          "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring changes to the AWS Config configuration will help ensure sustained visibility of the configuration items within the AWS account.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for AWS Configuration changes and uses the `` taken from audit step 1:  ```  aws logs put-metric-filter --log-group-name  --filter-name  --metric-transformations metricName=,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventSource = config.amazonaws.com) && (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.eventName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder)) }'  ```  **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify:  ```  aws sns create-topic --name   ```  **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms.  **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2:  ```  aws sns subscribe --topic-arn  --protocol  --notification-endpoint   ```  **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2:  ```  aws cloudwatch put-metric-alarm --alarm-name  --metric-name  --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions   ```",
+          "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`` - Note the `` within the value associated with CloudWatchLogsLogGroupArn  - Example: `arn:aws:logs:::log-group::*` - Ensure the identified multi-region CloudTrail trail is active:  - `aws cloudtrail get-trail-status --name `  - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events:  - `aws cloudtrail get-event-selectors --trail-name `  - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `` captured in step 1:  ```  aws logs describe-metric-filters --log-group-name   ``` 3. Ensure the output from the above command contains the following:  ```  filterPattern: { ($.eventSource = config.amazonaws.com) && (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.eventName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder)) }  ``` 4. Note the `` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `` captured in step 4:  ```  aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==]'  ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic:  ```  aws sns list-subscriptions-by-topic --topic-arn    ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN.  - Example of valid SubscriptionArn: `arn:aws:sns::::`",
+          "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+          "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.10",
+      "Description": "Ensure security group changes are monitored",
+      "Checks": [
+        "cloudwatch_log_metric_filter_security_group_changes"
+      ],
+      "Attributes": [
+        {
+          "Section": "4 Monitoring",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms.  Security groups are stateful packet filters that control ingress and egress traffic within a VPC. It is recommended that a metric filter and alarm be established to detect changes to security groups.",
+          "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring changes to security groups will help ensure that resources and services are not unintentionally exposed.",
+          "ImpactStatement": "This may require additional 'tuning' to eliminate false positives and filter out expected activity so that anomalies are easier to detect.",
+          "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for security groups changes and uses the `` taken from audit step 1:  ```  aws logs put-metric-filter --log-group-name  --filter-name  --metric-transformations metricName=,metricNamespace=CISBenchmark,metricValue=1 --filter-pattern { ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup) || ($.eventName = ModifySecurityGroupRules) }  ```  **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify:  ```  aws sns create-topic --name   ```  **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms.  **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2:  ```  aws sns subscribe --topic-arn  --protocol  --notification-endpoint   ```  **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2:  ```  aws cloudwatch put-metric-alarm --alarm-name  --metric-name  --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace CISBenchmark --alarm-actions   ```",
+          "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`` - Note the `` within the value associated with CloudWatchLogsLogGroupArn  - Example: `arn:aws:logs:::log-group::*` - Ensure the identified multi-region CloudTrail trail is active:  - `aws cloudtrail get-trail-status --name `  - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events:  - `aws cloudtrail get-event-selectors --trail-name `  - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `` captured in step 1:  ```  aws logs describe-metric-filters --log-group-name   ``` 3. Ensure the output from the above command contains the following:  ```  filterPattern: { ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup) || ($.eventName = ModifySecurityGroupRules) }  ``` 4. Note the `` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `` captured in step 4:  ```  aws cloudwatch describe-alarms --query MetricAlarms[?MetricName==]  ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic:  ```  aws sns list-subscriptions-by-topic --topic-arn    ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN.  - Example of valid SubscriptionArn: `arn:aws:sns::::`",
+          "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored AWS has recently introduced a new API, ModifySecurityGroupRules, which modifies the rules of a security group.",
+          "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html:https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySecurityGroupRules.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.11",
+      "Description": "Ensure Network Access Control List (NACL) changes are monitored",
+      "Checks": [
+        "cloudwatch_changes_to_network_acls_alarm_configured"
+      ],
+      "Attributes": [
+        {
+          "Section": "4 Monitoring",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms.  NACLs are used as a stateless packet filter to control ingress and egress traffic for subnets within a VPC. It is recommended that a metric filter and alarm be established for any changes made to NACLs.",
+          "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring changes to NACLs will help ensure that AWS resources and services are not unintentionally exposed.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for NACL changes and uses the `` taken from audit step 1:  ```  aws logs put-metric-filter --log-group-name  --filter-name  --metric-transformations metricName=,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) }'  ```  **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify:  ```  aws sns create-topic --name   ```  **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms.  **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2:  ```  aws sns subscribe --topic-arn  --protocol  --notification-endpoint   ```  **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2:  ```  aws cloudwatch put-metric-alarm --alarm-name  --metric-name  --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions   ```",
+          "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`` - Note the `` within the value associated with CloudWatchLogsLogGroupArn  - Example: `arn:aws:logs:::log-group::*` - Ensure the identified multi-region CloudTrail trail is active:  - `aws cloudtrail get-trail-status --name `  - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events:  - `aws cloudtrail get-event-selectors --trail-name `  - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `` captured in step 1:  ```  aws logs describe-metric-filters --log-group-name   ``` 3. Ensure the output from the above command contains the following:  ```  filterPattern: { ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) }  ``` 4. Note the `` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `` captured in step 4:  ```  aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==]'  ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic:  ```  aws sns list-subscriptions-by-topic --topic-arn    ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN.  - Example of valid SubscriptionArn: `arn:aws:sns::::`",
+          "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+          "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.12",
+      "Description": "Ensure changes to network gateways are monitored",
+      "Checks": [
+        "cloudwatch_changes_to_network_gateways_alarm_configured"
+      ],
+      "Attributes": [
+        {
+          "Section": "4 Monitoring",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms.  Network gateways are required to send and receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.",
+          "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring changes to network gateways will help ensure that all ingress/egress traffic traverses the VPC border via a controlled path.",
+          "ImpactStatement": "Monitoring changes to network gateways helps detect unauthorized modifications that could compromise network security. Implementing automated monitoring and alerts can improve incident response times, but it may require additional configuration and maintenance efforts.",
+          "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for network gateways changes and uses the `` taken from audit step 1:  ```  aws logs put-metric-filter --log-group-name  --filter-name  --metric-transformations metricName=,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }'  ```  **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify:  ```  aws sns create-topic --name   ```  **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms.  **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2:  ```  aws sns subscribe --topic-arn  --protocol  --notification-endpoint   ```  **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2:  ```  aws cloudwatch put-metric-alarm --alarm-name  --metric-name  --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions   ``` 5. Implement logging and alerting mechanisms:  ```  aws sns create-topic --name NetworkGatewayChangesAlerts  ````  ```  aws sns subscribe --topic-arn  --protocol email --notification-endpoint   ```  ```  aws cloudwatch put-metric-alarm --alarm-name NetworkGatewayChangesAlarm --metric-name GatewayChanges --namespace AWS/EC2 --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --alarm-actions   ```",
+          "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`` - Note the `` within the value associated with CloudWatchLogsLogGroupArn  - Example: `arn:aws:logs:::log-group::*` - Ensure the identified multi-region CloudTrail trail is active:  - `aws cloudtrail get-trail-status --name `  - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events:  - `aws cloudtrail get-event-selectors --trail-name `  - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `` captured in step 1:  ```  aws logs describe-metric-filters --log-group-name   ``` 3. Ensure the output from the above command contains the following:  ```  filterPattern: { ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }  ``` 4. Note the `` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `` captured in step 4:  ```  aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==]'  ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic:  ```  aws sns list-subscriptions-by-topic --topic-arn    ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN.  - Example of valid SubscriptionArn: `arn:aws:sns::::` 8. Ensure automated monitoring is enabled:  ```  aws cloudwatch put-metric-alarm --alarm-name NetworkGatewayChanges --metric-name GatewayChanges --namespace AWS/EC2 --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --alarm-actions   ```",
+          "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+          "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.13",
+      "Description": "Ensure route table changes are monitored",
+      "Checks": [
+        "cloudwatch_changes_to_network_route_tables_alarm_configured"
+      ],
+      "Attributes": [
+        {
+          "Section": "4 Monitoring",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms.  Routing tables are used to route network traffic between subnets and to network gateways. It is recommended that a metric filter and alarm be established for changes to route tables.",
+          "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring changes to route tables will help ensure that all VPC traffic flows through the expected path and prevent any accidental or intentional modifications that may lead to uncontrolled network traffic. An alarm should be triggered every time an AWS API call is performed to create, replace, delete, or disassociate a route table.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for route table changes and uses the `` taken from audit step 1:  ```  aws logs put-metric-filter --log-group-name  --filter-pattern '{ ($.eventName = CreateRoute) || ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable) }'  ```  **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify:  ```  aws sns create-topic --name   ```  **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms.  **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2:  ```  aws sns subscribe --topic-arn  --protocol  --notification-endpoint   ```  **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2:  ```  aws cloudwatch put-metric-alarm --alarm-name  --metric-name  --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions   ```",
+          "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`` - Note the `` within the value associated with CloudWatchLogsLogGroupArn  - Example: `arn:aws:logs:::log-group::*` - Ensure the identified multi-region CloudTrail trail is active:  - `aws cloudtrail get-trail-status --name `  - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events:  - `aws cloudtrail get-event-selectors --trail-name `  - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `` captured in step 1:  ```  aws logs describe-metric-filters --log-group-name   ``` 3. Ensure the output from the above command contains the following:  ```  filterPattern: {($.eventSource = ec2.amazonaws.com) && ($.eventName = CreateRoute) || ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable) }  ``` 4. Note the `` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `` captured in step 4:  ```  aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==]'  ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic:  ```  aws sns list-subscriptions-by-topic --topic-arn    ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN.  - Example of valid SubscriptionArn: `arn:aws:sns::::`",
+          "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+          "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.14",
+      "Description": "Ensure VPC changes are monitored",
+      "Checks": [
+        "cloudwatch_changes_to_vpcs_alarm_configured"
+      ],
+      "Attributes": [
+        {
+          "Section": "4 Monitoring",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms.  It is possible to have more than one VPC within an account; additionally, it is also possible to create a peer connection between two VPCs, enabling network traffic to route between them. It is recommended that a metric filter and alarm be established for changes made to VPCs.",
+          "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. VPCs in AWS are logically isolated virtual networks that can be used to launch AWS resources. Monitoring changes to VPC configurations will help ensure that VPC traffic flow is not negatively impacted. Changes to VPCs can affect network accessibility from the public internet and additionally impact VPC traffic flow to and from the resources launched in the VPC.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for VPC changes and uses the `` taken from audit step 1:  ```  aws logs put-metric-filter --log-group-name  --filter-name  --metric-transformations metricName=,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventName = CreateVpc) || ($.eventName = DeleteVpc) || ($.eventName = ModifyVpcAttribute) || ($.eventName = AcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) || ($.eventName = DeleteVpcPeeringConnection) || ($.eventName = RejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) || ($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink) || ($.eventName = EnableVpcClassicLink) }'  ```  **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify:  ```  aws sns create-topic --name   ```  **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms.  **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2:  ```  aws sns subscribe --topic-arn  --protocol  --notification-endpoint   ```  **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2:  ```  aws cloudwatch put-metric-alarm --alarm-name  --metric-name  --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions   ```",
+          "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`` - Note the `` within the value associated with CloudWatchLogsLogGroupArn  - Example: `arn:aws:logs:::log-group::*` - Ensure the identified multi-region CloudTrail trail is active:  - `aws cloudtrail get-trail-status --name `  - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events:  - `aws cloudtrail get-event-selectors --trail-name `  - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `` captured in step 1:  ```  aws logs describe-metric-filters --log-group-name   ``` 3. Ensure the output from the above command contains the following:  ```  filterPattern: { ($.eventName = CreateVpc) || ($.eventName = DeleteVpc) || ($.eventName = ModifyVpcAttribute) || ($.eventName = AcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) || ($.eventName = DeleteVpcPeeringConnection) || ($.eventName = RejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) || ($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink) || ($.eventName = EnableVpcClassicLink) }  ``` 4. Note the `` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `` captured in step 4:  ```  aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==]'  ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic:  ```  aws sns list-subscriptions-by-topic --topic-arn    ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN.  - Example of valid SubscriptionArn: `arn:aws:sns::::`",
+          "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+          "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.15",
+      "Description": "Ensure AWS Organizations changes are monitored",
+      "Checks": [
+        "cloudwatch_log_metric_filter_aws_organizations_changes"
+      ],
+      "Attributes": [
+        {
+          "Section": "4 Monitoring",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms.  It is recommended that a metric filter and alarm be established for changes made to AWS Organizations in the master AWS account.",
+          "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring AWS Organizations changes can help you prevent unwanted, accidental, or intentional modifications that may lead to unauthorized access or other security breaches. This monitoring technique helps ensure that any unexpected changes made within your AWS Organizations can be investigated and that any unwanted changes can be rolled back.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for AWS Organizations changes and uses the `` taken from audit step 1:  ```  aws logs put-metric-filter --log-group-name  --filter-name  --metric-transformations metricName=,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventSource = organizations.amazonaws.com) && (($.eventName = AcceptHandshake) || ($.eventName = AttachPolicy) || ($.eventName = CreateAccount) || ($.eventName = CreateOrganizationalUnit) || ($.eventName = CreatePolicy) || ($.eventName = DeclineHandshake) || ($.eventName = DeleteOrganization) || ($.eventName = DeleteOrganizationalUnit) || ($.eventName = DeletePolicy) || ($.eventName = DetachPolicy) || ($.eventName = DisablePolicyType) || ($.eventName = EnablePolicyType) || ($.eventName = InviteAccountToOrganization) || ($.eventName = LeaveOrganization) || ($.eventName = MoveAccount) || ($.eventName = RemoveAccountFromOrganization) || ($.eventName = UpdatePolicy) || ($.eventName = UpdateOrganizationalUnit)) }'  ```  **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify:  ```  aws sns create-topic --name   ```  **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms.  **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2:  ```  aws sns subscribe --topic-arn  --protocol  --notification-endpoint   ```  **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2:  ```  aws cloudwatch put-metric-alarm --alarm-name  --metric-name  --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions   ```",
+          "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`` - Note the `` within the value associated with CloudWatchLogsLogGroupArn  - Example: `arn:aws:logs:::log-group::*` - Ensure the identified multi-region CloudTrail trail is active:  - `aws cloudtrail get-trail-status --name `  - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events:  - `aws cloudtrail get-event-selectors --trail-name `  - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `` captured in step 1:  ```  aws logs describe-metric-filters --log-group-name   ``` 3. Ensure the output from the above command contains the following:  ```  filterPattern: { ($.eventSource = organizations.amazonaws.com) && (($.eventName = AcceptHandshake) || ($.eventName = AttachPolicy) || ($.eventName = CreateAccount) || ($.eventName = CreateOrganizationalUnit) || ($.eventName = CreatePolicy) || ($.eventName = DeclineHandshake) || ($.eventName = DeleteOrganization) || ($.eventName = DeleteOrganizationalUnit) || ($.eventName = DeletePolicy) || ($.eventName = DetachPolicy) || ($.eventName = DisablePolicyType) || ($.eventName = EnablePolicyType) || ($.eventName = InviteAccountToOrganization) || ($.eventName = LeaveOrganization) || ($.eventName = MoveAccount) || ($.eventName = RemoveAccountFromOrganization) || ($.eventName = UpdatePolicy) || ($.eventName = UpdateOrganizationalUnit)) }  ``` 4. Note the `` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `` captured in step 4:  ```  aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==]'  ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic:  ```  aws sns list-subscriptions-by-topic --topic-arn    ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN.  - Example of valid SubscriptionArn: `arn:aws:sns::::`",
+          "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+          "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/organizations/latest/userguide/orgs_security_incident-response.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.16",
+      "Description": "Ensure AWS Security Hub is enabled",
+      "Checks": [
+        "securityhub_enabled"
+      ],
+      "Attributes": [
+        {
+          "Section": "4 Monitoring",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Automated",
+          "Description": "Security Hub collects security data from various AWS accounts, services, and supported third-party partner products, helping you analyze your security trends and identify the highest-priority security issues. When you enable Security Hub, it begins to consume, aggregate, organize, and prioritize findings from the AWS services that you have enabled, such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie. You can also enable integrations with AWS partner security products.",
+          "RationaleStatement": "AWS Security Hub provides you with a comprehensive view of your security state in AWS and helps you check your environment against security industry standards and best practices, enabling you to quickly assess the security posture across your AWS accounts.",
+          "ImpactStatement": "It is recommended that AWS Security Hub be enabled in all regions. AWS Security Hub requires that AWS Config be enabled.",
+          "RemediationProcedure": "To grant the permissions required to enable Security Hub, attach the Security Hub managed policy `AWSSecurityHubFullAccess` to an IAM user, group, or role. Enabling Security Hub: **From Console:** 1. Use the credentials of the IAM identity to sign in to the Security Hub console. 2. When you open the Security Hub console for the first time, choose `Go to Security Hub`. 3. The `Security standards` section on the welcome page lists supported security standards. Check the box for a standard to enable it. 3. Choose `Enable Security Hub`. **From Command Line:** 1. Run the `enable-security-hub` command, including `--enable-default-standards` to enable the default standards: ``` aws securityhub enable-security-hub --enable-default-standards ``` 2. To enable Security Hub without the default standards, include `--no-enable-default-standards`: ``` aws securityhub enable-security-hub --no-enable-default-standards ```",
+          "AuditProcedure": "Follow this process to evaluate AWS Security Hub configuration per region: **From Console:** 1. Sign in to the AWS Management Console and open the AWS Security Hub console at https://console.aws.amazon.com/securityhub/. 2. On the top right of the console, select the target Region. 3. If the Security Hub > Summary page is displayed, then Security Hub is set up for the selected region. 4. If presented with Setup Security Hub or Get Started With Security Hub, refer to the remediation steps. 5. Repeat steps 2 to 4 for each region. **From Command Line:** Run the following command to verify the Security Hub status: ``` aws securityhub describe-hub ``` This will list the Security Hub status by region. Check for a 'SubscribedAt' value. Example output: ``` {  HubArn: ,  SubscribedAt: 2022-08-19T17:06:42.398Z,  AutoEnableControls: true } ``` An error will be returned if Security Hub is not enabled. Example error: ``` An error occurred (InvalidAccessException) when calling the DescribeHub operation: Account  is not subscribed to AWS Security Hub ```",
+          "AdditionalInformation": "",
+          "References": "https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-get-started.html:https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-enable.html#securityhub-enable-api:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/securityhub/enable-security-hub.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "5.2",
+      "Description": "Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports",
+      "Checks": [
+        "ec2_networkacl_allow_ingress_any_port",
+        "ec2_networkacl_allow_ingress_tcp_port_22",
+        "ec2_networkacl_allow_ingress_tcp_port_3389"
+      ],
+      "Attributes": [
+        {
+          "Section": "5 Networking",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Automated",
+          "Description": "The Network Access Control List (NACL) function provides stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH on port `22` and RDP on port `3389`, using either the TCP (6), UDP (17), or ALL (-1) protocols.",
+          "RationaleStatement": "Public access to remote server administration ports, such as 22 (when used for SSH, not SFTP) and 3389, increases the attack surface of resources and unnecessarily raises the risk of resource compromise.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "**From Console:** Perform the following steps to remediate a network ACL: 1. Login to the AWS VPC Console at https://console.aws.amazon.com/vpc/home. 2. In the left pane, click `Network ACLs`. 3. For each network ACL that needs remediation, perform the following:  - Select the network ACL.  - Click the `Inbound Rules` tab.  - Click `Edit inbound rules`.  - Either A) update the Source field to a range other than 0.0.0.0/0, or B) click `Delete` to remove the offending inbound rule.  - Click `Save`.",
+          "AuditProcedure": "**From Console:** Perform the following steps to determine if the account is configured as prescribed: 1. Login to the AWS VPC Console at https://console.aws.amazon.com/vpc/home. 2. In the left pane, click `Network ACLs`. 3. For each network ACL, perform the following:  - Select the network ACL.  - Click the `Inbound Rules` tab.  - Ensure that no rule exists which has a port range that includes port `22` or `3389`, uses the protocols TCP (6), UDP (17), or ALL (-1), or other remote server administration ports for your environment, has a `Source` of `0.0.0.0/0`, and shows `ALLOW`. **Note:** A port value of `ALL` or a port range such as `0-3389` includes port `22`, `3389`, and potentially other remote server administration ports.",
+          "AdditionalInformation": "",
+          "References": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html:https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Security.html#VPC_Security_Comparison",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "5.3",
+      "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports",
+      "Checks": [
+        "ec2_securitygroup_allow_ingress_from_internet_to_all_ports",
+        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
+        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389"
+      ],
+      "Attributes": [
+        {
+          "Section": "5 Networking",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Automated",
+          "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH on port `22` and RDP on port `3389`, using either the TCP (6), UDP (17), or ALL (-1) protocols.",
+          "RationaleStatement": "Public access to remote server administration ports, such as 22 (when used for SSH, not SFTP) and 3389, increases the attack surface of resources and unnecessarily raises the risk of resource compromise.",
+          "ImpactStatement": "When updating an existing environment, ensure that administrators have access to remote server administration ports through another mechanism before removing access by deleting the 0.0.0.0/0 inbound rule.",
+          "RemediationProcedure": "Perform the following to implement the prescribed state: 1. Login to the AWS VPC Console at [https://console.aws.amazon.com/vpc/home](https://console.aws.amazon.com/vpc/home). 2. In the left pane, click `Security Groups`. 3. For each security group, perform the following:  - Select the security group.  - Click the `Inbound Rules` tab.  - Click the `Edit inbound rules` button.  - Identify the rules to be edited or removed.  - Either A) update the Source field to a range other than 0.0.0.0/0, or B) click `Delete` to remove the offending inbound rule.  - Click `Save rules`.",
+          "AuditProcedure": "Perform the following to determine if the account is configured as prescribed: 1. Login to the AWS VPC Console at [https://console.aws.amazon.com/vpc/home](https://console.aws.amazon.com/vpc/home). 2. In the left pane, click `Security Groups`. 3. For each security group, perform the following:  - Select the security group.  - Click the `Inbound Rules` tab.  - Ensure that no rule exists which has a port range including port `22` or `3389`, uses the protocols TCP (6), UDP (17), or ALL (-1), or other remote server administration ports for your environment, and has a `Source` of `0.0.0.0/0`. **Note:** A port value of `ALL` or a port range such as `0-3389` includes port `22`, `3389`, and potentially other remote server administration ports.",
+          "AdditionalInformation": "",
+          "References": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html#deleting-security-group-rule",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "5.4",
+      "Description": "Ensure no security groups allow ingress from ::/0 to remote server administration ports",
+      "Checks": [
+        "ec2_securitygroup_allow_ingress_from_internet_to_all_ports",
+        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
+        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389"
+      ],
+      "Attributes": [
+        {
+          "Section": "5 Networking",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Automated",
+          "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH on port `22` and RDP on port `3389`.",
+          "RationaleStatement": "Public access to remote server administration ports, such as 22 (when used for SSH, not SFTP) and 3389, increases attack surface of resources and unnecessarily raises the risk of resource compromise.",
+          "ImpactStatement": "When updating an existing environment, ensure that administrators have access to remote server administration ports through another mechanism before removing access by deleting the ::/0 inbound rule.",
+          "RemediationProcedure": "Perform the following to implement the prescribed state: 1. Login to the AWS VPC Console at [https://console.aws.amazon.com/vpc/home](https://console.aws.amazon.com/vpc/home). 2. In the left pane, click `Security Groups`. 3. For each security group, perform the following:  - Select the security group.  - Click the `Inbound Rules` tab.  - Click the `Edit inbound rules` button.  - Identify the rules to be edited or removed.  - Either A) update the Source field to a range other than ::/0, or B) Click `Delete` to remove the offending inbound rule.  - Click `Save rules`.",
+          "AuditProcedure": "Perform the following to determine if the account is configured as prescribed: 1. Login to the AWS VPC Console at [https://console.aws.amazon.com/vpc/home](https://console.aws.amazon.com/vpc/home). 2. In the left pane, click `Security Groups`. 3. For each security group, perform the following:  - Select the security group.  - Click the `Inbound Rules` tab.  - Ensure that no rule exists which has a port range including port `22`, `3389`, or other remote server administration ports for your environment, and has a `Source` of `::/0`. **Note:** A port value of `ALL` or a port range such as `0-3389` includes port `22`, `3389`, and potentially other remote server administration ports.",
+          "AdditionalInformation": "",
+          "References": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html#deleting-security-group-rule",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "5.5",
+      "Description": "Ensure the default security group of every VPC restricts all traffic",
+      "Checks": [
+        "ec2_securitygroup_default_restrict_traffic"
+      ],
+      "Attributes": [
+        {
+          "Section": "5 Networking",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Automated",
+          "Description": "A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If a security group is not specified when an instance is launched, it is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic, both inbound and outbound. The default VPC in every region should have its default security group updated to comply with the following:  - No inbound rules.  - No outbound rules. Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation. **Note:** When implementing this recommendation, VPC flow logging is invaluable in determining the least privilege port access required by systems to work properly, as it can log all packet acceptances and rejections occurring under the current security groups. This dramatically reduces the primary barrier to least privilege engineering by discovering the minimum ports required by systems in the environment. Even if the VPC flow logging recommendation in this benchmark is not adopted as a permanent security measure, it should be used during any period of discovery and engineering for least privileged security groups.",
+          "RationaleStatement": "Configuring all VPC default security groups to restrict all traffic will encourage the development of least privilege security groups and promote the mindful placement of AWS resources into security groups, which will, in turn, reduce the exposure of those resources.",
+          "ImpactStatement": "Implementing this recommendation in an existing VPC that contains operating resources requires extremely careful migration planning, as the default security groups are likely enabling many ports that are unknown. Enabling VPC flow logging (for accepted connections) in an existing environment that is known to be breach-free will reveal the current pattern of ports being used for each instance to communicate successfully. The migration process should include: - Analyzing VPC flow logs to understand current traffic patterns. - Creating least privilege security groups based on the analyzed data. - Testing the new security group rules in a staging environment before applying them to production.",
+          "RemediationProcedure": "Perform the following to implement the prescribed state: **Security Group Members** 1. Identify AWS resources that exist within the default security group. 2. Create a set of least-privilege security groups for those resources. 3. Place the resources in those security groups, removing the resources noted in step 1 from the default security group. **Security Group State** 1. Login to the AWS VPC Console at [https://console.aws.amazon.com/vpc/home](https://console.aws.amazon.com/vpc/home). 2. Repeat the following steps for all VPCs, including the default VPC in each AWS region: 3. In the left pane, click `Security Groups`. 4. For each default security group, perform the following:  - Select the `default` security group.  - Click the `Inbound Rules` tab.  - Remove any inbound rules.  - Click the `Outbound Rules` tab.  - Remove any Outbound rules. **Recommended** IAM groups allow you to edit the name field. After remediating default group rules for all VPCs in all regions, edit this field to add text similar to DO NOT USE. DO NOT ADD RULES.",
+          "AuditProcedure": "Perform the following to determine if the account is configured as prescribed: **Security Group State** 1. Login to the AWS VPC Console at [https://console.aws.amazon.com/vpc/home](https://console.aws.amazon.com/vpc/home). 2. Repeat the following steps for all VPCs, including the default VPC in each AWS region: 3. In the left pane, click `Security Groups`. 4. For each default security group, perform the following:  - Select the `default` security group.  - Click the `Inbound Rules` tab and ensure no rules exist.  - Click the `Outbound Rules` tab and ensure no rules exist. **Security Group Members** 1. Login to the AWS VPC Console at [https://console.aws.amazon.com/vpc/home](https://console.aws.amazon.com/vpc/home). 2. Repeat the following steps for all default groups in all VPCs, including the default VPC in each AWS region: 3. In the left pane, click `Security Groups`. 4. Copy the ID of the default security group. 5. Change to the EC2 Management Console at https://console.aws.amazon.com/ec2/v2/home. 6. In the filter column type `Security Group ID : `.",
+          "AdditionalInformation": "",
+          "References": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html#default-security-group",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "5.6",
+      "Description": "Ensure routing tables for VPC peering are least access",
+      "Checks": [
+        "vpc_peering_routing_tables_with_least_privilege"
+      ],
+      "Attributes": [
+        {
+          "Section": "5 Networking",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Once a VPC peering connection is established, routing tables must be updated to enable any connections between the peered VPCs. These routes can be as specific as desired, even allowing for the peering of a VPC to only a single host on the other side of the connection.",
+          "RationaleStatement": "Being highly selective in peering routing tables is a very effective way to minimize the impact of a breach, as resources outside of these routes are inaccessible to the peered VPC.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Remove and add route table entries to ensure that the least number of subnets or hosts required to accomplish the purpose of peering are routable. **From Command Line:** 1. For each `` that contains routes that are non-compliant with your routing policy (granting more access than desired), delete the non-compliant route: ``` aws ec2 delete-route --route-table-id  --destination-cidr-block  ``` 2. Create a new compliant route: ``` aws ec2 create-route --route-table-id  --destination-cidr-block  --vpc-peering-connection-id  ```",
+          "AuditProcedure": "Review the routing tables of peered VPCs to determine whether they route all subnets of each VPC and whether this is necessary to accomplish the intended purposes of peering the VPCs. **From Command Line:** 1. List all the route tables from a VPC and check if the GatewayId is pointing to a `` (e.g., pcx-1a2b3c4d) and if the DestinationCidrBlock is as specific as desired: ``` aws ec2 describe-route-tables --filter Name=vpc-id,Values= --query RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes, AssociatedSubnets:Associations[*].SubnetId} ```",
+          "AdditionalInformation": "If an organization has an AWS Transit Gateway implemented in its VPC architecture, it should look to apply the recommendation above for a least access routing architecture at the AWS Transit Gateway level, in combination with what must be implemented at the standard VPC route table. More specifically, to route traffic between two or more VPCs via a Transit Gateway, VPCs must have an attachment to a Transit Gateway route table as well as a route. Therefore, to avoid routing traffic between VPCs, an attachment to the Transit Gateway route table should only be added where there is an intention to route traffic between the VPCs. As Transit Gateways are capable of hosting multiple route tables, it is possible to group VPCs by attaching them to a common route table.",
+          "References": "https://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/peering-configurations-partial-access.html:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/create-vpc-peering-connection.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "5.7",
+      "Description": "Ensure that the EC2 Metadata Service only allows IMDSv2",
+      "Checks": [
+        "ec2_instance_imdsv2_enabled"
+      ],
+      "Attributes": [
+        {
+          "Section": "5 Networking",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Automated",
+          "Description": "When enabling the Metadata Service on AWS EC2 instances, users have the option of using either Instance Metadata Service Version 1 (IMDSv1; a request/response method) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method).",
+          "RationaleStatement": "Instance metadata is data about your instance that you can use to configure or manage the running instance. Instance metadata is divided into [categories](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html), such as host name, events, and security groups. When enabling the Metadata Service on AWS EC2 instances, users have the option of using either Instance Metadata Service Version 1 (IMDSv1; a request/response method) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method). With IMDSv2, every request is now protected by session authentication. A session begins and ends a series of requests that software running on an EC2 instance uses to access the locally stored EC2 instance metadata and credentials. Allowing Version 1 of the service may open EC2 instances to Server-Side Request Forgery (SSRF) attacks, so Amazon recommends utilizing Version 2 for better instance security.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "From Console: 1. Sign in to the AWS Management Console and navigate to the EC2 dashboard at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). 2. In the left navigation panel, under the `INSTANCES` section, choose `Instances`. 3. Select the EC2 instance that you want to examine. 4. Choose `Actions > Instance Settings > Modify instance metadata options`. 5. Set `Instance metadata service` to `Enable`. 6. Set `IMDSv2` to `Required`. 7. Repeat steps 1-6 to perform the remediation process for other EC2 instances in all applicable AWS region(s). From Command Line: 1. Run the `describe-instances` command, applying the appropriate filters to list the IDs of all existing EC2 instances currently available in the selected region:  ```   aws ec2 describe-instances --region  --output table --query Reservations[*].Instances[*].InstanceId  ``` 2. The command output should return a table with the requested instance IDs. 3. Run the `modify-instance-metadata-options` command with an instance ID obtained from the previous step to update the Instance Metadata Version:  ```  aws ec2 modify-instance-metadata-options --instance-id  --http-tokens required --region   ``` 4. Repeat steps 1-3 to perform the remediation process for other EC2 instances in the same AWS region. 5. Change the region by updating `--region` and repeat the process for other regions.",
+          "AuditProcedure": "From Console: 1. Sign in to the AWS Management Console and navigate to the EC2 dashboard at https://console.aws.amazon.com/ec2/. 2. In the left navigation panel, under the `INSTANCES` section, choose `Instances`. 3. Select the EC2 instance that you want to examine. 4. Check the `IMDSv2` status, and ensure that it is set to `Required`. From Command Line: 1. Run the `describe-instances` command using appropriate filters to list the IDs of all existing EC2 instances currently available in the selected region:  ```  aws ec2 describe-instances --region  --output table --query Reservations[*].Instances[*].InstanceId  ``` 2. The command output should return a table with the requested instance IDs. 3. Run the `describe-instances` command using the instance ID returned in the previous step and apply custom filtering to determine whether the selected instance is using IMDSv2:  ```  aws ec2 describe-instances --region  --instance-ids  --query Reservations[*].Instances[*].MetadataOptions --output table  ``` 4. Ensure that for all EC2 instances, `HttpTokens` is set to `required` and `State` is set to `applied`. 5. Repeat steps 3 and 4 to verify the other EC2 instances provisioned within the current region. 6. Repeat steps 1–5 to perform the audit process for other AWS regions.",
+          "AdditionalInformation": "",
+          "References": "https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/:https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "5.1.1",
+      "Description": "Ensure EBS volume encryption is enabled in all regions",
+      "Checks": [
+        "ec2_ebs_volume_encryption"
+      ],
+      "Attributes": [
+        {
+          "Section": "5 Networking",
+          "SubSection": "5.1 Elastic Compute Cloud (EC2)",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Automated",
+          "Description": "Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service. While disabled by default, forcing encryption at EBS volume creation is supported.",
+          "RationaleStatement": "Encrypting data at rest reduces the likelihood of unintentional exposure and can nullify the impact of disclosure if the encryption remains unbroken.",
+          "ImpactStatement": "Losing access to or removing the KMS key used by the EBS volumes will result in the inability to access the volumes.",
+          "RemediationProcedure": "**From Console:** 1. Login to the AWS Management Console and open the Amazon EC2 console using https://console.aws.amazon.com/ec2/. 2. Under `Account attributes`, click `EBS encryption`. 3. Click `Manage`. 4. Check the `Enable` box. 5. Click `Update EBS encryption`. 6. Repeat for each region in which EBS volume encryption is not enabled by default. **Note:** EBS volume encryption is configured per region. **From Command Line:** 1. Run the following command: ``` aws --region  ec2 enable-ebs-encryption-by-default ``` 2. Verify that `EbsEncryptionByDefault: true` is displayed. 3. Repeat for each region in which EBS volume encryption is not enabled by default. **Note:** EBS volume encryption is configured per region.",
+          "AuditProcedure": "**From Console:** 1. Login to the AWS Management Console and open the Amazon EC2 console using https://console.aws.amazon.com/ec2/. 2. Under `Settings`, click `EBS encryption`. 3. Verify `Always encrypt new EBS volumes` displays `Enabled`. 4. Repeat for each region in use. **Note:** EBS volume encryption is configured per region. **From Command Line:** 1. Run the following command: ``` aws --region  ec2 get-ebs-encryption-by-default ``` 2. Verify that `EbsEncryptionByDefault: true` is displayed. 3. Repeat for each region in use. **Note:** EBS volume encryption is configured per region.",
+          "AdditionalInformation": "Default EBS volume encryption only applies to newly created EBS volumes; existing EBS volumes are **not** converted automatically.",
+          "References": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html:https://aws.amazon.com/blogs/aws/new-opt-in-to-default-encryption-for-new-ebs-volumes/",
+          "DefaultValue": ""
+        }
+      ]
+    },
+    {
+      "Id": "5.1.2",
+      "Description": "Ensure CIFS access is restricted to trusted networks to prevent unauthorized access",
+      "Checks": [
+        "ec2_instance_port_cifs_exposed_to_internet"
+      ],
+      "Attributes": [
+        {
+          "Section": "5 Networking",
+          "SubSection": "5.1 Elastic Compute Cloud (EC2)",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Automated",
+          "Description": "Common Internet File System (CIFS) is a network file-sharing protocol that allows systems to share files over a network. However, unrestricted CIFS access can expose your data to unauthorized users, leading to potential security risks. It is important to restrict CIFS access to only trusted networks and users to prevent unauthorized access and data breaches.",
+          "RationaleStatement": "Allowing unrestricted CIFS access can lead to significant security vulnerabilities, as it may allow unauthorized users to access sensitive files and data. By restricting CIFS access to known and trusted networks, you can minimize the risk of unauthorized access and protect sensitive data from exposure to potential attackers. Implementing proper network access controls and permissions is essential for maintaining the security and integrity of your file-sharing systems.",
+          "ImpactStatement": "Restricting CIFS access may require additional configuration and management effort. However, the benefits of enhanced security and reduced risk of unauthorized access to sensitive data far outweigh the potential challenges.",
+          "RemediationProcedure": "**From Console:** 1. Login to the AWS Management Console. 2. Navigate to the EC2 Dashboard and select the Security Groups section under `Network & Security`. 3. Identify the security group that allows unrestricted ingress on port 445. 4. Select the security group and click the `Edit Inbound Rules` button. 5. Locate the rule allowing unrestricted access on port 445 (typically listed as `0.0.0.0/0` or `::/0`). 6. Modify the rule to restrict access to specific IP ranges or trusted networks only. 7. Save the changes to the security group. **From Command Line:** 1. Run the following command to remove or modify the unrestricted rule for CIFS access:  ```  aws ec2 revoke-security-group-ingress --region  --group-id  --protocol tcp --port 445 --cidr 0.0.0.0/0  ```  - Optionally, run the `authorise-security-group-ingress` command to create a new rule, specifying a trusted CIDR range instead of `0.0.0.0/0`. 2. Confirm the changes by describing the security group again and ensuring the unrestricted access rule has been removed or appropriately restricted:  ```  aws ec2 describe-security-groups --region  --group-ids  --query 'SecurityGroups[*].IpPermissions[?ToPort==`445`].{CIDR:IpRanges[*].CidrIp,Port:ToPort}'  ``` 3. Repeat the remediation for other security groups and regions as necessary.",
+          "AuditProcedure": "**From Console:** 1. Login to the AWS Management Console. 2. Navigate to the EC2 Dashboard and select the Security Groups section under `Network & Security`. 3. Identify the security groups associated with instances or resources that may be using CIFS. 4. Review the inbound rules of each security group to check for rules that allow unrestricted access on port 445 (the port used by CIFS).  - Specifically, look for inbound rules that allow access from `0.0.0.0/0` or `::/0` on port 445. 5. Document any instances where unrestricted access is allowed and verify whether it is necessary for the specific use case. **From Command Line:** 1. Run the following command to list all security groups and identify those associated with CIFS:  ```  aws ec2 describe-security-groups --region  --query 'SecurityGroups[*].GroupId'  ``` 2. Check for any inbound rules that allow unrestricted access on port 445 using the following command:  ```  aws ec2 describe-security-groups --region  --group-ids  --query 'SecurityGroups[*].IpPermissions[?ToPort==`445`].{CIDR:IpRanges[*].CidrIp,Port:ToPort}'  ```  - Look for `0.0.0.0/0` or `::/0` in the output, which indicates unrestricted access. 3. Repeat the audit for other regions and security groups as necessary.",
+          "AdditionalInformation": "",
+          "References": "",
+          "DefaultValue": ""
+        }
+      ]
+    }
+  ]
+}
diff --git a/prowler/compliance/azure/cis_2.0_azure.json b/prowler/compliance/azure/cis_2.0_azure.json
index 59ab14879d..94983dab94 100644
--- a/prowler/compliance/azure/cis_2.0_azure.json
+++ b/prowler/compliance/azure/cis_2.0_azure.json
@@ -12,7 +12,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.1 Security Defaults",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -35,7 +35,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.1 Security Defaults",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -58,7 +58,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.1 Security Defaults",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -79,7 +79,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.1 Security Defaults",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -102,7 +102,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.2 Conditional Access",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -123,7 +123,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.2 Conditional Access",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -144,7 +144,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.2 Conditional Access",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -165,7 +165,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.2 Conditional Access",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -186,7 +186,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.2 Conditional Access",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -207,7 +207,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.2 Conditional Access",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -230,7 +230,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Require administrators or appropriately delegated users to create new tenants.",
@@ -250,7 +250,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "This recommendation extends guest access review by utilizing the Azure AD Privileged Identity Management feature provided in Azure AD Premium P2. Azure AD is extended to include Azure AD B2B collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities. Guest users allow you to share your company's applications and services with users from any other organization, while maintaining control over your own corporate data. Work with external partners, large or small, even if they don't have Azure AD or an IT department. A simple invitation and redemption process lets partners use their own credentials to access your company's resources a a guest user.",
@@ -270,7 +270,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Azure AD is extended to include Azure AD B2B collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities. Guest users allow you to share your company's applications and services with users from any other organization, while maintaining control over your own corporate data. Work with external partners, large or small, even if they don't have Azure AD or an IT department. A simple invitation and redemption process lets partners use their own credentials to access your company's resources as a guest user. Guest users in every subscription should be review on a regular basis to ensure that inactive and unneeded accounts are removed.",
@@ -290,7 +290,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Ensures that two alternate forms of identification are provided before allowing a password reset.",
@@ -310,7 +310,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Microsoft Azure provides a Global Banned Password policy that applies to Azure administrative and normal user accounts. This is not applied to user accounts that are synced from an on-premise Active Directory unless Azure AD Connect is used and you enable EnforceCloudPasswordPolicyForPasswordSyncedUsers. Please see the list in default values on the specifics of this policy. To further password security, it is recommended to further define a custom banned password policy.",
@@ -330,7 +330,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0.",
@@ -350,7 +350,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Ensure that users are notified on their primary and secondary emails on password resets.",
@@ -370,7 +370,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Ensure that all Global Administrators are notified if any other administrator resets their password.",
@@ -392,7 +392,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Require administrators to provide consent for applications before use.",
@@ -414,7 +414,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Allow users to provide consent for selected permissions when a request is coming from a verified publisher.",
@@ -434,7 +434,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Require administrators to provide consent for the apps before use.",
@@ -456,7 +456,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Require administrators or appropriately delegated users to register third-party applications.",
@@ -478,7 +478,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Limit guest user permissions.",
@@ -500,7 +500,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Restrict invitations to users with specific administrative roles only.",
@@ -520,7 +520,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Restrict access to the Azure AD administration portal to administrators only. NOTE: This only affects access to the Azure AD administrator's web portal. This setting does not prohibit privileged users from using other methods such as Rest API or Powershell to obtain sensitive information from Azure AD.",
@@ -540,7 +540,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Restricts group creation to administrators with permissions only.",
@@ -562,7 +562,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Restrict security group creation to administrators only.",
@@ -582,7 +582,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Restrict security group management to administrators only.",
@@ -604,7 +604,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Restrict Microsoft 365 group creation to administrators only.",
@@ -624,7 +624,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Joining or registering devices to the active directory should require Multi-factor authentication.",
@@ -646,7 +646,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The principle of least privilege should be followed and only necessary privileges should be assigned instead of allowing full administrative access.",
@@ -668,7 +668,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Resource locking is a powerful protection mechanism that can prevent inadvertent modification/deletion of resources within Azure subscriptions/Resource Groups and is a recommended NIST configuration.",
@@ -688,7 +688,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Users who are set as subscription owners are able to make administrative changes to the subscriptions and move them into and out of Azure Active Directories.",
@@ -710,7 +710,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -733,7 +733,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -756,7 +756,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -779,7 +779,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -802,7 +802,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -825,7 +825,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -848,7 +848,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -871,7 +871,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -894,7 +894,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -917,7 +917,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -940,7 +940,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -963,7 +963,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -986,7 +986,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -1009,7 +1009,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -1032,7 +1032,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -1055,7 +1055,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -1076,7 +1076,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -1099,7 +1099,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -1122,7 +1122,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1145,7 +1145,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1168,7 +1168,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -1191,7 +1191,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -1214,7 +1214,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.2 Microsoft Defender for IoT",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -1237,7 +1237,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enable data encryption in transit.",
@@ -1259,7 +1259,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Enabling encryption at the hardware level on top of the default software encryption for Storage Accounts accessing Azure storage solutions.",
@@ -1279,7 +1279,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Access Keys authenticate application access requests to data contained in Storage Accounts. A periodic rotation of these keys is recommended to ensure that potentially compromised keys cannot result in a long-term exploitable credential. The 'Rotation Reminder' is an automatic reminder feature for a manual procedure.",
@@ -1301,7 +1301,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "For increased security, regenerate storage account access keys periodically.",
@@ -1321,7 +1321,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "The Storage Queue service stores messages that may be read by any client who has access to the storage account. A queue can contain an unlimited number of messages, each of which can be up to 64KB in size using version 2011-08-18 or newer. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the queues. Storage Logging log entries contain the following information about individual requests: Timing information such as start time, end-to-end latency, and server latency, authentication details, concurrency information, and the sizes of the request and response messages.",
@@ -1341,7 +1341,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Expire shared access signature tokens within an hour.",
@@ -1363,7 +1363,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Disallowing public access for a storage account overrides the public access settings for individual containers in that storage account.",
@@ -1385,7 +1385,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Restricting default network access helps to provide a new layer of security, since storage accounts accept connections from clients on any network. To limit access to selected networks, the default action must be changed.",
@@ -1407,7 +1407,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Some Azure services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Azure services to bypass the network rules. These services will then use strong authentication to access the storage account. If the Allow trusted Azure services exception is enabled, the following services are granted access to the storage account: Azure Backup, Azure Site Recovery, Azure DevTest Labs, Azure Event Grid, Azure Event Hubs, Azure Networking, Azure Monitor, and Azure SQL Data Warehouse (when registered in the subscription).",
@@ -1429,7 +1429,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Use private endpoints for your Azure Storage accounts to allow clients and services to securely access data located over a network via an encrypted Private Link. To do this, the private endpoint uses an IP address from the VNet for each service. Network traffic between disparate services securely traverses encrypted over the VNet. This VNet can also link addressing space, extending your network and accessing resources on it. Similarly, it can be a tunnel through public networks to connect remote infrastructures together. This creates further security through segmenting network traffic and preventing outside sources from accessing it.",
@@ -1451,7 +1451,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The Azure Storage blobs contain data like ePHI or Financial, which can be secret or personal. Data that is erroneously modified or deleted by an application or other storage account user will cause data loss or unavailability. It is recommended that both Azure Containers with attached Blob Storage and standalone containers with Blob Storage be made recoverable by enabling the soft delete configuration. This is to save and recover data when blobs or blob snapshots are deleted.",
@@ -1473,7 +1473,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Enable sensitive data encryption at rest using Customer Managed Keys rather than Microsoft Managed keys.",
@@ -1493,7 +1493,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "The Storage Blob service provides scalable, cost-efficient object storage in the cloud. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the blobs. Storage Logging log entries contain the following information about individual requests: timing information such as start time, end-to-end latency, and server latency; authentication details; concurrency information; and the sizes of the request and response messages.",
@@ -1513,7 +1513,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Azure Table storage is a service that stores structured NoSQL data in the cloud, providing a key/attribute store with a schema-less design. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the tables. Storage Logging log entries contain the following information about individual requests: timing information such as start time, end-to-end latency, and server latency; authentication details; concurrency information; and the sizes of the request and response messages.",
@@ -1535,7 +1535,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "In some cases, Azure Storage sets the minimum TLS versio n to be version 1.0 by default. TLS 1.0 is a legacy version and has known vulnerabilities. This minimum TLSversion can be configured to be later protocols such as TLS 1.2.",
@@ -1557,7 +1557,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.1 SQL Server - Auditing",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1580,7 +1580,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.1 SQL Server - Auditing",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1603,7 +1603,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.1 SQL Server - Auditing",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -1626,7 +1626,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.1 SQL Server - Auditing",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1649,7 +1649,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.1 SQL Server - Auditing",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1672,7 +1672,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.1 SQL Server - Auditing",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1695,7 +1695,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.2 SQL Server - Microsoft Defender for SQL",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -1718,7 +1718,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.2 SQL Server - Microsoft Defender for SQL",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -1741,7 +1741,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.2 SQL Server - Microsoft Defender for SQL",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -1764,7 +1764,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.2 SQL Server - Microsoft Defender for SQL",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -1787,7 +1787,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.2 SQL Server - Microsoft Defender for SQL",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1810,7 +1810,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.3 PostgreSQL Database Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1833,7 +1833,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.3 PostgreSQL Database Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1856,7 +1856,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.3 PostgreSQL Database Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1879,7 +1879,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.3 PostgreSQL Database Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1902,7 +1902,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.3 PostgreSQL Database Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1925,7 +1925,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.3 PostgreSQL Database Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1948,7 +1948,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.3 PostgreSQL Database Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1969,7 +1969,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.3 PostgreSQL Database Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1992,7 +1992,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.4 MySQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2015,7 +2015,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.4 MySQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2038,7 +2038,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.4 MySQL Database",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -2061,7 +2061,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.4 MySQL Database",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -2084,7 +2084,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.5 Cosmos DB",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -2107,7 +2107,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.5 Cosmos DB",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -2130,7 +2130,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.5 Cosmos DB",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -2153,7 +2153,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.1 Configuring Diagnostic Settings",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -2176,7 +2176,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.1 Configuring Diagnostic Settings",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2199,7 +2199,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.1 Configuring Diagnostic Settings",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2222,7 +2222,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.1 Configuring Diagnostic Settings",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -2245,7 +2245,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.1 Configuring Diagnostic Settings",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2268,7 +2268,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.1 Configuring Diagnostic Settings",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -2291,7 +2291,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.1 Configuring Diagnostic Settings",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -2314,7 +2314,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2337,7 +2337,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2360,7 +2360,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2383,7 +2383,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2406,7 +2406,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2429,7 +2429,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2452,7 +2452,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2475,7 +2475,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2498,7 +2498,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2521,7 +2521,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2542,7 +2542,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Resource Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself; for example, reading or updating a secret from a Key Vault. Currently, 95 Azure resources support Azure Monitoring (See the more information section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps, and CosmosDB. The content of these logs varies by resource type. A number of back-end services were not configured to log and store Resource Logs for certain activities or for a sufficient length. It is crucial that monitoring is correctly configured to log all relevant activities and retain those logs for a sufficient length of time. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.",
@@ -2562,7 +2562,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "The use of Basic or Free SKUs in Azure whilst cost effective have significant limitations in terms of what can be monitored and what support can be realized from Microsoft. Typically, these SKU’s do not have a service SLA and Microsoft will usually refuse to provide support for them. Consequently Basic/Free SKUs should never be used for production workloads.",
@@ -2584,7 +2584,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.3 Configuring Application Insights",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -2607,7 +2607,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Networking",
+          "Section": "6 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required.",
@@ -2629,7 +2629,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Networking",
+          "Section": "6 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required.",
@@ -2651,7 +2651,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Networking",
+          "Section": "6 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required.",
@@ -2673,7 +2673,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Networking",
+          "Section": "6 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required and narrowly configured.",
@@ -2695,7 +2695,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Networking",
+          "Section": "6 Networking",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Network Security Group Flow Logs should be enabled and the retention period set to greater than or equal to 90 days.",
@@ -2717,7 +2717,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Networking",
+          "Section": "6 Networking",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Enable Network Watcher for Azure subscriptions.",
@@ -2737,7 +2737,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "6. Networking",
+          "Section": "6 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Public IP Addresses provide tenant accounts with Internet connectivity for resources contained within the tenant. During the creation of certain resources in Azure, a Public IP Address may be created. All Public IP Addresses within the tenant should be periodically reviewed for accuracy and necessity.",
@@ -2759,7 +2759,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. Virtual Machines",
+          "Section": "7 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "The Azure Bastion service allows secure remote access to Azure Virtual Machines over the Internet without exposing remote access protocol ports and services directly to the Internet. The Azure Bastion service provides this access using TLS over 443/TCP, and subscribes to hardened configurations within an organization's Azure Active Directory service.",
@@ -2781,7 +2781,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. Virtual Machines",
+          "Section": "7 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Migrate blob-based VHDs to Managed Disks on Virtual Machines to exploit the default features of this configuration. The features include: 1. Default Disk Encryption 2. Resilience, as Microsoft will managed the disk storage and move around if underlying hardware goes faulty 3. Reduction of costs over storage accounts",
@@ -2803,7 +2803,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. Virtual Machines",
+          "Section": "7 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that OS disks (boot volumes) and data disks  (non-boot volumes) are encrypted with CMK (Customer Managed Keys). Customer Managed keys can be either ADE orServer Side Encryption (SSE).",
@@ -2825,7 +2825,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. Virtual Machines",
+          "Section": "7 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that unattached disks in a subscription are encrypted with a Customer Managed Key (CMK).",
@@ -2845,7 +2845,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "7. Virtual Machines",
+          "Section": "7 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "For added security, only install organization-approved extensions on VMs.",
@@ -2867,7 +2867,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. Virtual Machines",
+          "Section": "7 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Install endpoint protection for all virtual machines.",
@@ -2887,7 +2887,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "7. Virtual Machines",
+          "Section": "7 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "NOTE: This is a legacy recommendation. Managed Disks are encrypted by default and recommended for all new VM implementations. VHD (Virtual Hard Disks) are stored in blob storage and are the old-style disks that were attached to Virtual Machines. The blob VHD was then leased to the VM. By default, storage accounts are not encrypted, and Microsoft Defender will then recommend that the OS disks should be encrypted. Storage accounts can be encrypted as a whole using PMK or CMK. This should be turned on for storage accounts containing VHDs",
@@ -2909,7 +2909,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Key Vault",
+          "Section": "8 Key Vault",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that all Keys in Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.",
@@ -2931,7 +2931,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Key Vault",
+          "Section": "8 Key Vault",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that all Keys in Non Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.",
@@ -2953,7 +2953,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Key Vault",
+          "Section": "8 Key Vault",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that all Secrets in Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.",
@@ -2975,7 +2975,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Key Vault",
+          "Section": "8 Key Vault",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that all Secrets in Non Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.",
@@ -2997,7 +2997,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Key Vault",
+          "Section": "8 Key Vault",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The Key Vault contains object keys, secrets, and certificates. Accidental unavailability of a Key Vault can cause immediate data loss or loss of security functions (authentication, validation, verification, non-repudiation, etc.) supported by the Key Vault objects. It is recommended the Key Vault be made recoverable by enabling the 'Do Not Purge' and 'Soft Delete' functions. This is in order to prevent loss of encrypted data, including storage accounts, SQL databases, and/or dependent services provided by Key Vault objects (Keys, Secrets, Certificates) etc. This may happen in the case of accidental deletion by a user or from disruptive activity by a malicious user. WARNING: A current limitation of the soft-delete feature across all Azure services is role assignments disappearing when Key Vault is deleted. All role assignments will need to be recreated after recovery.",
@@ -3019,7 +3019,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Key Vault",
+          "Section": "8 Key Vault",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "WARNING: Role assignments disappear when a Key Vault has been deleted (soft-delete) and recovered. Afterwards it will be required to recreate all role assignments. This is a limitation of the soft-delete feature across all Azure services.",
@@ -3041,7 +3041,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Key Vault",
+          "Section": "8 Key Vault",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Private endpoints will secure network traffic from Azure Key Vault to the resources requesting secrets and keys.",
@@ -3063,7 +3063,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Key Vault",
+          "Section": "8 Key Vault",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Automatic Key Rotation is available in Public Preview. The currently supported applications are Key Vault, Managed Disks, and Storage accounts accessing keys within Key Vault. The number of supported applications will incrementally increased.",
@@ -3085,7 +3085,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Azure App Service Authentication is a feature that can prevent anonymous HTTP requests from reaching a Web Application or authenticate those with tokens before they reach the app. If an anonymous request is received from a browser, App Service will redirect to a logon page. To handle the logon process, a choice from a set of identity providers can be made, or a custom authentication mechanism can be implemented.",
@@ -3107,7 +3107,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Azure Web Apps allows sites to run under both HTTP and HTTPS by default. Web apps can be accessed by anyone using non-secure HTTP links by default. Non-secure HTTP requests can be restricted and all HTTP requests redirected to the secure HTTPS port. It is recommended to enforce HTTPS-only traffic.",
@@ -3129,7 +3129,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The TLS (Transport Layer Security) protocol secures transmission of data over the internet using standard encryption technology. Encryption should be set with the latest version of TLS. App service allows TLS 1.2 by default, which is the recommended TLS level by industry standards such as PCI DSS.",
@@ -3151,7 +3151,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Client certificates allow for the app to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app.",
@@ -3173,7 +3173,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Managed service identity in App Service provides more security by eliminating secrets from the app, such as credentials in the connection strings. When registering with Azure Active Directory in App Service, the app will connect to other Azure services securely without the need for usernames and passwords.",
@@ -3195,7 +3195,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Periodically newer versions are released for PHP software either due to security flaws or to include additional functionality. Using the latest PHP version for web apps is recommended in order to take advantage of security fixes, if any, and/or additional functionalities of the newer version.",
@@ -3217,7 +3217,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest full Python version for web apps is recommended in order to take advantage of security fixes, if any, and/or additional functionalities of the newer version.",
@@ -3239,7 +3239,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the newer version.",
@@ -3261,7 +3261,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to takeadvantage of security fixes, if any, and/or new functionalities of the newer version.",
@@ -3283,7 +3283,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "By default, Azure Functions, Web, and API Services can be deployed over FTP. If FTP is required for an essential deployment workflow, FTPS should be required for FTP login for all App Service Apps and Functions.",
@@ -3303,7 +3303,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Azure Key Vault will store multiple types of sensitive information such as encryption keys, certificate thumbprints, and Managed Identity Credentials. Access to these 'Secrets' can be controlled through granular permissions.",
@@ -3323,7 +3323,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "10. Miscellaneous",
+          "Section": "10 Miscellaneous",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Resource Manager Locks provide a way for administrators to lock down Azure resources to prevent deletion of, or modifications to, a resource. These locks sit outside of the Role Based Access Controls (RBAC) hierarchy and, when applied, will place restrictions on the resource for all users. These locks are very useful when there is an important resource in a subscription that users should not be able to delete or change. Locks can help prevent accidental and malicious changes or deletion.",
diff --git a/prowler/compliance/azure/cis_2.1_azure.json b/prowler/compliance/azure/cis_2.1_azure.json
index 594b2ad851..e6b6a128cf 100644
--- a/prowler/compliance/azure/cis_2.1_azure.json
+++ b/prowler/compliance/azure/cis_2.1_azure.json
@@ -12,7 +12,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Require administrators or appropriately delegated users to create new tenants.",
@@ -32,7 +32,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Microsoft Entra ID is extended to include Azure AD B2B collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities. Guest users allow you to share your company's applications and services with users from any other organization, while maintaining control over your own corporate data.   Work with external partners, large or small, even if they don't have Azure AD or an IT department. A simple invitation and redemption process lets partners use their own credentials to access your company's resources as a guest user.  Guest users in every subscription should be review on a regular basis to ensure that inactive and unneeded accounts are removed.",
@@ -52,7 +52,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Ensures that two alternate forms of identification are provided before allowing a password reset.",
@@ -72,7 +72,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Microsoft Azure provides a Global Banned Password policy that applies to Azure administrative and normal user accounts. This is not applied to user accounts that are synced from an on-premise Active Directory unless Microsoft Entra ID Connect is used and you enable EnforceCloudPasswordPolicyForPasswordSyncedUsers. Please see the list in default values on the specifics of this policy. To further password security, it is recommended to further define a custom banned password policy.",
@@ -92,7 +92,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0.",
@@ -112,7 +112,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Ensure that users are notified on their primary and secondary emails on password resets.",
@@ -132,7 +132,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Ensure that all Global Administrators are notified if any other administrator resets their password.",
@@ -154,7 +154,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Require administrators to provide consent for applications before use.",
@@ -176,7 +176,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Allow users to provide consent for selected permissions when a request is coming from a verified publisher.",
@@ -196,7 +196,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Require administrators to provide consent for the apps before use.",
@@ -218,7 +218,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Require administrators or appropriately delegated users to register third-party applications.",
@@ -240,7 +240,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Limit guest user permissions.",
@@ -262,7 +262,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Restrict invitations to users with specific administrative roles only.",
@@ -282,7 +282,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Restrict access to the Microsoft Entra ID administration center to administrators only.  **NOTE**: This only affects access to the Entra ID administrator's web portal. This setting does not prohibit privileged users from using other methods such as Rest API or Powershell to obtain sensitive information from Microsoft Entra ID.",
@@ -302,7 +302,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Restrict access to group web interface in the Access Panel portal.",
@@ -324,7 +324,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Restrict security group creation to administrators only.",
@@ -344,7 +344,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Restrict security group management to administrators only.",
@@ -366,7 +366,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Restrict Microsoft 365 group creation to administrators only.",
@@ -386,7 +386,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Joining or registering devices to Microsoft Entra ID should require Multi-factor authentication.",
@@ -408,7 +408,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The principle of least privilege should be followed and only necessary privileges should be assigned instead of allowing full administrative access.",
@@ -430,7 +430,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Resource locking is a powerful protection mechanism that can prevent inadvertent modification/deletion of resources within Azure subscriptions/Resource Groups and is a recommended NIST configuration.",
@@ -450,7 +450,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Users who are set as subscription owners are able to make administrative changes to the subscriptions and move them into and out of Microsoft Entra ID.",
@@ -472,7 +472,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "This recommendation aims to maintain a balance between security and operational efficiency by ensuring that a minimum of 2 and a maximum of 4 users are assigned the Global Administrator role in Microsoft Entra ID. Having at least two Global Administrators ensures redundancy, while limiting the number to four reduces the risk of excessive privileged access.",
@@ -494,7 +494,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.1 Security Defaults Security Defaults",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -517,7 +517,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.1 Security Defaults Security Defaults",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -540,7 +540,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.1 Security Defaults Security Defaults",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -561,7 +561,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.1 Security Defaults Security Defaults",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -584,7 +584,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.2 Conditional Access",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -605,7 +605,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.2 Conditional Access",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -626,7 +626,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.2 Conditional Access",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -647,7 +647,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.2 Conditional Access",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -668,7 +668,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.2 Conditional Access",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -691,7 +691,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.2 Conditional Access",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -712,7 +712,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "SubSection": "1.2 Conditional Access",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -735,7 +735,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -758,7 +758,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -781,7 +781,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -804,7 +804,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -827,7 +827,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -850,7 +850,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -873,7 +873,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -896,7 +896,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -919,7 +919,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -942,7 +942,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -965,7 +965,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -988,7 +988,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1011,7 +1011,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -1034,7 +1034,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1057,7 +1057,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -1078,7 +1078,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -1101,7 +1101,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1124,7 +1124,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1147,7 +1147,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1170,7 +1170,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -1193,7 +1193,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -1214,7 +1214,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.1 Microsoft Defender for Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -1237,7 +1237,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Microsoft Defender",
+          "Section": "2 Microsoft Defender",
           "SubSection": "2.2 Microsoft Defender for IoT",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -1260,7 +1260,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enable data encryption in transit.",
@@ -1282,7 +1282,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Enabling encryption at the hardware level on top of the default software encryption for Storage Accounts accessing Azure storage solutions.",
@@ -1302,7 +1302,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Access Keys authenticate application access requests to data contained in Storage Accounts. A periodic rotation of these keys is recommended to ensure that potentially compromised keys cannot result in a long-term exploitable credential. The Rotation Reminder is an automatic reminder feature for a manual procedure.",
@@ -1324,7 +1324,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "For increased security, regenerate storage account access keys periodically.",
@@ -1344,7 +1344,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "The Storage Queue service stores messages that may be read by any client who has access to the storage account. A queue can contain an unlimited number of messages, each of which can be up to 64KB in size using version 2011-08-18 or newer. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the queues. Storage Logging log entries contain the following information about individual requests: Timing information such as start time, end-to-end latency, and server latency, authentication details, concurrency information, and the sizes of the request and response messages.",
@@ -1364,7 +1364,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Expire shared access signature tokens within an hour.",
@@ -1386,7 +1386,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Disallowing public network access for a storage account overrides the public access settings for individual containers in that storage account for Azure Resource Manager Deployment Model storage accounts. Azure Storage accounts that use the classic deployment model will be retired on August 31, 2024.",
@@ -1408,7 +1408,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Restricting default network access helps to provide a new layer of security, since storage accounts accept connections from clients on any network. To limit access to selected networks, the default action must be changed.",
@@ -1430,7 +1430,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Some Azure services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Azure services to bypass the network rules. These services will then use strong authentication to access the storage account. If the Allow trusted Azure services exception is enabled, the following services are granted access to the storage account: Azure Backup, Azure Site Recovery, Azure DevTest Labs, Azure Event Grid, Azure Event Hubs, Azure Networking, Azure Monitor, and Azure SQL Data Warehouse (when registered in the subscription).",
@@ -1452,7 +1452,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Use private endpoints for your Azure Storage accounts to allow clients and services to securely access data located over a network via an encrypted Private Link. To do this, the private endpoint uses an IP address from the VNet for each service. Network traffic between disparate services securely traverses encrypted over the VNet. This VNet can also link addressing space, extending your network and accessing resources on it. Similarly, it can be a tunnel through public networks to connect remote infrastructures together. This creates further security through segmenting network traffic and preventing outside sources from accessing it.",
@@ -1474,7 +1474,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The Azure Storage blobs contain data like ePHI or Financial, which can be secret or personal. Data that is erroneously modified or deleted by an application or other storage account user will cause data loss or unavailability.  It is recommended that both Azure Containers with attached Blob Storage and standalone containers with Blob Storage be made recoverable by enabling the **soft delete** configuration. This is to save and recover data when blobs or blob snapshots are deleted.",
@@ -1496,7 +1496,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Enable sensitive data encryption at rest using Customer Managed Keys (CMK) rather than Microsoft Managed keys.",
@@ -1516,7 +1516,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "The Storage Blob service provides scalable, cost-efficient object storage in the cloud. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the blobs. Storage Logging log entries contain the following information about individual requests: timing information such as start time, end-to-end latency, and server latency; authentication details; concurrency information; and the sizes of the request and response messages.",
@@ -1536,7 +1536,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Azure Table storage is a service that stores structured NoSQL data in the cloud, providing a key/attribute store with a schema-less design. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the tables. Storage Logging log entries contain the following information about individual requests: timing information such as start time, end-to-end latency, and server latency; authentication details; concurrency information; and the sizes of the request and response messages.",
@@ -1558,7 +1558,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "In some cases, Azure Storage sets the minimum TLS version to be version 1.0 by default. TLS 1.0 is a legacy version and has known vulnerabilities. This minimum TLS version can be configured to be later protocols such as TLS 1.2.",
@@ -1578,7 +1578,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Cross Tenant Replication in Azure allows data to be replicated across multiple Azure tenants. While this feature can be beneficial for data sharing and availability, it also poses a significant security risk if not properly managed. Unauthorized data access, data leakage, and compliance violations are potential risks. Disabling Cross Tenant Replication ensures that data is not inadvertently replicated across different tenant boundaries without explicit authorization.",
@@ -1598,7 +1598,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Storage Accounts",
+          "Section": "3 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The Azure Storage setting ‘Allow Blob Anonymous Access’ (aka allowBlobPublicAccess) controls whether anonymous access is allowed for blob data in a storage account. When this property is set to True, it enables public read access to blob data, which can be convenient for sharing data but may carry security risks. When set to False, it disallows public access to blob data, providing a more secure storage environment.",
@@ -1620,7 +1620,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.1 SQL Server - Auditing",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1643,7 +1643,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.1 SQL Server - Auditing",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1666,7 +1666,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.1 SQL Server - Auditing",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -1689,7 +1689,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.1 SQL Server - Auditing",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1712,7 +1712,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.1 SQL Server - Auditing",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1735,7 +1735,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.1 SQL Server - Auditing",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1758,7 +1758,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1781,7 +1781,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1804,7 +1804,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1827,7 +1827,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1850,7 +1850,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1873,7 +1873,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1896,7 +1896,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1917,7 +1917,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1940,7 +1940,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.4 MySQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1963,7 +1963,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.4 MySQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -1986,7 +1986,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.4 MySQL Database",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -2009,7 +2009,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.4 MySQL Database",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -2032,7 +2032,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.5 Cosmos DB",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -2055,7 +2055,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.5 Cosmos DB",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -2078,7 +2078,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Database Services",
+          "Section": "4 Database Services",
           "SubSection": "4.5 Cosmos DB",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -2099,7 +2099,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Resource Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself; for example, reading or updating a secret from a Key Vault. Currently, 95 Azure resources support Azure Monitoring (See the more information section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps, and CosmosDB. The content of these logs varies by resource type.  A number of back-end services were not configured to log and store Resource Logs for certain activities or for a sufficient length. It is crucial that monitoring is correctly configured to log all relevant activities and retain those logs for a sufficient length of time. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.",
@@ -2119,7 +2119,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "The use of Basic or Free SKUs in Azure whilst cost effective have significant limitations in terms of what can be monitored and what support can be realized from Microsoft. Typically, these SKU’s do not have a service SLA and Microsoft may refuse to provide support for them. Consequently Basic/Free SKUs should never be used for production workloads.",
@@ -2141,7 +2141,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.1 Configuring Diagnostic Settings",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
@@ -2164,7 +2164,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.1 Configuring Diagnostic Settings",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2187,7 +2187,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.1 Configuring Diagnostic Settings",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -2210,7 +2210,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.1 Configuring Diagnostic Settings",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2233,7 +2233,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.1 Configuring Diagnostic Settings",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -2256,7 +2256,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.1 Configuring Diagnostic Settings",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
@@ -2279,7 +2279,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2302,7 +2302,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2325,7 +2325,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2348,7 +2348,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2371,7 +2371,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2394,7 +2394,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2417,7 +2417,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2440,7 +2440,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2463,7 +2463,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2486,7 +2486,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
@@ -2509,7 +2509,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5 Logging and Monitoring",
           "SubSection": "5.3 Configuring Application Insights. Storage Accounts",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -2532,7 +2532,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Networking",
+          "Section": "6 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required.",
@@ -2554,7 +2554,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Networking",
+          "Section": "6 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required.",
@@ -2576,7 +2576,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Networking",
+          "Section": "6 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required.",
@@ -2598,7 +2598,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Networking",
+          "Section": "6 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required and narrowly configured.",
@@ -2620,7 +2620,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Networking",
+          "Section": "6 Networking",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Network Security Group Flow Logs should be enabled and the retention period set to greater than or equal to 90 days.",
@@ -2642,7 +2642,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Networking",
+          "Section": "6 Networking",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Enable Network Watcher for physical regions in Azure subscriptions.",
@@ -2662,7 +2662,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "6. Networking",
+          "Section": "6 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Public IP Addresses provide tenant accounts with Internet connectivity for resources contained within the tenant. During the creation of certain resources in Azure, a Public IP Address may be created. All Public IP Addresses within the tenant should be periodically reviewed for accuracy and necessity.",
@@ -2684,7 +2684,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. Virtual Machines",
+          "Section": "7 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "The Azure Bastion service allows secure remote access to Azure Virtual Machines over the Internet without exposing remote access protocol ports and services directly to the Internet. The Azure Bastion service provides this access using TLS over 443/TCP, and subscribes to hardened configurations within an organization's Azure Active Directory service.",
@@ -2706,7 +2706,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. Virtual Machines",
+          "Section": "7 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Migrate blob-based VHDs to Managed Disks on Virtual Machines to exploit the default features of this configuration. The features include:  1) Default Disk Encryption 2) Resilience, as Microsoft will managed the disk storage and move around if underlying hardware goes faulty 3) Reduction of costs over storage accounts",
@@ -2728,7 +2728,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. Virtual Machines",
+          "Section": "7 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that OS disks (boot volumes) and data disks (non-boot volumes) are encrypted with CMK (Customer Managed Keys). Customer Managed keys can be either ADE or Server Side Encryption (SSE).",
@@ -2750,7 +2750,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. Virtual Machines",
+          "Section": "7 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that unattached disks in a subscription are encrypted with a Customer Managed Key (CMK).",
@@ -2770,7 +2770,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "7. Virtual Machines",
+          "Section": "7 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "For added security, only install organization-approved extensions on VMs.",
@@ -2792,7 +2792,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. Virtual Machines",
+          "Section": "7 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Install endpoint protection for all virtual machines.",
@@ -2812,7 +2812,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "7. Virtual Machines",
+          "Section": "7 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "**NOTE: This is a legacy recommendation. Managed Disks are encrypted by default and recommended for all new VM implementations.**  VHD (Virtual Hard Disks) are stored in blob storage and are the old-style disks that were attached to Virtual Machines. The blob VHD was then leased to the VM. By default, storage accounts are not encrypted, and Microsoft Defender will then recommend that the OS disks should be encrypted. Storage accounts can be encrypted as a whole using PMK or CMK. This should be turned on for storage accounts containing VHDs.",
@@ -2834,7 +2834,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. Virtual Machines",
+          "Section": "7 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Verify identities without MFA that can log in to a privileged virtual machine using separate login credentials. An adversary can leverage the access to move laterally and perform actions with the virtual machine's managed identity. Make sure the virtual machine only has necessary permissions, and revoke the admin-level permissions according to the least privileges principal",
@@ -2856,7 +2856,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. Virtual Machines",
+          "Section": "7 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "When **Secure Boot** and **vTPM** are enabled together, they provide a strong foundation for protecting your VM from boot attacks. For example, if an attacker attempts to replace the bootloader with a malicious version, Secure Boot will prevent the VM from booting. If the attacker is able to bypass Secure Boot and install a malicious bootloader, vTPM can be used to detect the intrusion and alert you.",
@@ -2878,7 +2878,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Key Vault",
+          "Section": "8 Key Vault",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that all Keys in Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.",
@@ -2900,7 +2900,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Key Vault",
+          "Section": "8 Key Vault",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that all Keys in Non Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.",
@@ -2922,7 +2922,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Key Vault",
+          "Section": "8 Key Vault",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that all Secrets in Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.",
@@ -2944,7 +2944,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Key Vault",
+          "Section": "8 Key Vault",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that all Secrets in Non Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.",
@@ -2966,7 +2966,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Key Vault",
+          "Section": "8 Key Vault",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The Key Vault contains object keys, secrets, and certificates. Accidental unavailability of a Key Vault can cause immediate data loss or loss of security functions (authentication, validation, verification, non-repudiation, etc.) supported by the Key Vault objects.  It is recommended the Key Vault be made recoverable by enabling the Do Not Purge and Soft Delete functions. This is in order to prevent loss of encrypted data, including storage accounts, SQL databases, and/or dependent services provided by Key Vault objects (Keys, Secrets, Certificates) etc. This may happen in the case of accidental deletion by a user or from disruptive activity by a malicious user.  WARNING: A current limitation is that role assignments disappearing when Key Vault is deleted. All role assignments will need to be recreated after recovery.",
@@ -2988,7 +2988,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Key Vault",
+          "Section": "8 Key Vault",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "WARNING: Role assignments disappear when a Key Vault has been deleted (soft-delete) and recovered. Afterwards it will be required to recreate all role assignments. This is a limitation of the soft-delete feature across all Azure services.",
@@ -3010,7 +3010,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Key Vault",
+          "Section": "8 Key Vault",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Private endpoints will secure network traffic from Azure Key Vault to the resources requesting secrets and keys.",
@@ -3032,7 +3032,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Key Vault",
+          "Section": "8 Key Vault",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Automatic Key Rotation is available in Public Preview. The currently supported applications are Key Vault, Managed Disks, and Storage accounts accessing keys within Key Vault. The number of supported applications will incrementally increased.",
@@ -3054,7 +3054,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Azure App Service Authentication is a feature that can prevent anonymous HTTP requests from reaching a Web Application or authenticate those with tokens before they reach the app. If an anonymous request is received from a browser, App Service will redirect to a logon page. To handle the logon process, a choice from a set of identity providers can be made, or a custom authentication mechanism can be implemented.",
@@ -3076,7 +3076,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Azure Web Apps allows sites to run under both HTTP and HTTPS by default. Web apps can be accessed by anyone using non-secure HTTP links by default.  Non-secure HTTP requests can be restricted and all HTTP requests redirected to the secure HTTPS port. It is recommended to enforce HTTPS-only traffic.",
@@ -3098,7 +3098,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The TLS (Transport Layer Security) protocol secures transmission of data over the internet using standard encryption technology. Encryption should be set with the latest version of TLS. App service allows TLS 1.2 by default, which is the recommended TLS level by industry standards such as PCI DSS.",
@@ -3120,7 +3120,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Managed service identity in App Service provides more security by eliminating secrets from the app, such as credentials in the connection strings. When registering an App Service with Entra ID, the app will connect to other Azure services securely without the need for usernames and passwords.",
@@ -3142,7 +3142,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Periodically newer versions are released for PHP software either due to security flaws or to include additional functionality. Using the latest PHP version for web apps is recommended in order to take advantage of security fixes, if any, and/or additional functionalities of the newer version.",
@@ -3164,7 +3164,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest full Python version for web apps is recommended in order to take advantage of security fixes, if any, and/or additional functionalities of the newer version.",
@@ -3186,7 +3186,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the newer version.",
@@ -3208,7 +3208,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version.",
@@ -3230,7 +3230,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "By default, Azure Functions, Web, and API Services  can be deployed over FTP. If FTP is required for an essential deployment workflow, FTPS should be required for FTP login for all App Service Apps and Functions.",
@@ -3250,7 +3250,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Azure Key Vault will store multiple types of sensitive information such as encryption keys, certificate thumbprints, and Managed Identity Credentials. Access to these 'Secrets' can be controlled through granular permissions.",
@@ -3270,7 +3270,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "10. Miscellaneous",
+          "Section": "10 Miscellaneous",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Resource Manager Locks provide a way for administrators to lock down Azure resources to prevent deletion of, or modifications to, a resource. These locks sit outside of the Role Based Access Controls (RBAC) hierarchy and, when applied, will place restrictions on the resource for all users. These locks are very useful when there is an important resource in a subscription that users should not be able to delete or change. Locks can help prevent accidental and malicious changes or deletion.",
diff --git a/prowler/compliance/azure/cis_3.0_azure.json b/prowler/compliance/azure/cis_3.0_azure.json
index 4175dd2a7e..0ba6c77444 100644
--- a/prowler/compliance/azure/cis_3.0_azure.json
+++ b/prowler/compliance/azure/cis_3.0_azure.json
@@ -12,7 +12,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Require administrators or appropriately delegated users to create new tenants.",
@@ -32,7 +32,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Microsoft Entra ID has native and extended identity functionality allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities.",
@@ -52,7 +52,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Ensures that two alternate forms of identification are provided before allowing a password reset.",
@@ -72,7 +72,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "The account lockout threshold determines how many failed login attempts are permitted prior to placing the account in a locked-out state and initiating a variable lockout duration.",
@@ -92,7 +92,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "The account lockout duration value determines how long an account retains the status of lockout, and therefore how long before a user can continue to attempt to login after passing the lockout threshold.",
@@ -112,7 +112,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Microsoft Azure provides a Global Banned Password policy that applies to Azure administrative and normal user accounts. This is not applied to user accounts that are synced from an on-premise Active Directory unless Microsoft Entra ID Connect is used and you enable EnforceCloudPasswordPolicyForPasswordSyncedUsers.Please see the list in default values on the specifics of this policy. To further password security, it is recommended to further define a custom banned password policy.",
@@ -132,7 +132,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0.",
@@ -152,7 +152,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Ensure that users are notified on their primary and alternate emails on password resets.",
@@ -172,7 +172,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Ensure that all Global Administrators are notified if any other administrator resets their password.",
@@ -194,7 +194,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Require administrators to provide consent for applications before use.",
@@ -216,7 +216,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Allow users to provide consent for selected permissions when a request is coming from a verified publisher.",
@@ -238,7 +238,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Require administrators or appropriately delegated users to register third-party applications.",
@@ -260,7 +260,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Limit guest user permissions.",
@@ -282,7 +282,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Restrict invitations to users with specific administrative roles only.",
@@ -302,7 +302,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Restrict access to the Microsoft Entra ID administration center to administrators only.**NOTE**: This only affects access to the Entra ID administrator's web portal. This setting does not prohibit privileged users from using other methods such as Rest API or Powershell to obtain sensitive information from Microsoft Entra ID.",
@@ -322,7 +322,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Restrict access to group web interface in the Access Panel portal.",
@@ -344,7 +344,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Restrict security group creation to administrators only.",
@@ -364,7 +364,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Restrict security group management to administrators only.",
@@ -386,7 +386,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Restrict Microsoft 365 group creation to administrators only.",
@@ -406,7 +406,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "**NOTE:** This recommendation is only relevant if your subscription is using Per-User MFA. If your organization is licensed to use Conditional Access, the preferred method of requiring MFA to join devices to Entra ID is to use a Conditional Access policy (see additional information below for link).Joining or registering devices to Microsoft Entra ID should require multi-factor authentication.",
@@ -428,7 +428,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The principle of least privilege should be followed and only necessary privileges should be assigned instead of allowing full administrative access.",
@@ -450,7 +450,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Resource locking is a powerful protection mechanism that can prevent inadvertent modification/deletion of resources within Azure subscriptions/Resource Groups and is a recommended NIST configuration.",
@@ -470,7 +470,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Users who are set as subscription owners are able to make administrative changes to the subscriptions and move them into and out of Microsoft Entra ID.",
@@ -492,7 +492,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Identity",
+          "Section": "2 Identity",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "This recommendation aims to maintain a balance between security and operational efficiency by ensuring that a minimum of 2 and a maximum of 4 users are assigned the Global Administrator role in Microsoft Entra ID. Having at least two Global Administrators ensures redundancy, while limiting the number to four reduces the risk of excessive privileged access.",
@@ -514,8 +514,8 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Identity",
-          "SubSection": "2.1. Security Defaults (Per-User MFA)",
+          "Section": "2 Identity",
+          "SubSection": "2.1 Security Defaults (Per-User MFA)",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "[**IMPORTANT - Please read the section overview:** If your organization pays for Microsoft Entra ID licensing (included in Microsoft 365 E3, E5, or F5, and EM&S E3 or E5 licenses) and **CAN** use Conditional Access, ignore the recommendations in this section and proceed to the Conditional Access section.]Security defaults in Microsoft Entra ID make it easier to be secure and help protect your organization. Security defaults contain preconfigured security settings for common attacks.Security defaults is available to everyone. The goal is to ensure that all organizations have a basic level of security enabled at no extra cost. You may turn on security defaults in the Azure portal.",
@@ -537,8 +537,8 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Identity",
-          "SubSection": "2.1. Security Defaults (Per-User MFA)",
+          "Section": "2 Identity",
+          "SubSection": "2.1 Security Defaults (Per-User MFA)",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "[**IMPORTANT - Please read the section overview:** If your organization pays for Microsoft Entra ID licensing (included in Microsoft 365 E3, E5, or F5, and EM&S E3 or E5 licenses) and **CAN** use Conditional Access, ignore the recommendations in this section and proceed to the Conditional Access section.]Enable multi-factor authentication for all roles, groups, and users that have write access or permissions to Azure resources. These include custom created objects or built-in roles such as;- Service Co-Administrators- Subscription Owners- Contributors",
@@ -560,8 +560,8 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Identity",
-          "SubSection": "2.1. Security Defaults (Per-User MFA)",
+          "Section": "2 Identity",
+          "SubSection": "2.1 Security Defaults (Per-User MFA)",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "[**IMPORTANT - Please read the section overview:** If your organization pays for Microsoft Entra ID licensing (included in Microsoft 365 E3, E5, or F5, and EM&S E3 or E5 licenses) and **CAN** use Conditional Access, ignore the recommendations in this section and proceed to the Conditional Access section.]Enable multi-factor authentication for all non-privileged users.",
@@ -581,8 +581,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Identity",
-          "SubSection": "2.1. Security Defaults (Per-User MFA)",
+          "Section": "2 Identity",
+          "SubSection": "2.1 Security Defaults (Per-User MFA)",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "[**IMPORTANT - Please read the section overview:** If your organization pays for Microsoft Entra ID licensing (included in Microsoft 365 E3, E5, or F5, and EM&S E3 or E5 licenses) and **CAN** use Conditional Access, ignore the recommendations in this section and proceed to the Conditional Access section.]Do not allow users to remember multi-factor authentication on devices.",
@@ -604,8 +604,8 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Identity",
-          "SubSection": "2.2. Conditional Access",
+          "Section": "2 Identity",
+          "SubSection": "2.2 Conditional Access",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Microsoft Entra ID Conditional Access allows an organization to configure `Named locations` and configure whether those locations are trusted or untrusted. These settings provide organizations the means to specify Geographical locations for use in conditional access policies, or define actual IP addresses and IP ranges and whether or not those IP addresses and/or ranges are trusted by the organization.",
@@ -625,8 +625,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Identity",
-          "SubSection": "2.2. Conditional Access",
+          "Section": "2 Identity",
+          "SubSection": "2.2 Conditional Access",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "**CAUTION**: If these policies are created without first auditing and testing the result, misconfiguration can potentially lock out administrators or create undesired access issues.Conditional Access Policies can be used to block access from geographic locations that are deemed out-of-scope for your organization or application. The scope and variables for this policy should be carefully examined and defined.",
@@ -646,8 +646,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Identity",
-          "SubSection": "2.2. Conditional Access",
+          "Section": "2 Identity",
+          "SubSection": "2.2 Conditional Access",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Conditional Access Policies can be used to prevent the Device code authentication flow. Device code flow should be permitted only for users that regularly perform duties that explicitly require the use of Device Code to authenticate, such as utilizing Azure with PowerShell.",
@@ -667,8 +667,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Identity",
-          "SubSection": "2.2. Conditional Access",
+          "Section": "2 Identity",
+          "SubSection": "2.2 Conditional Access",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "For designated users, they will be prompted to use their multi-factor authentication (MFA) process on login.",
@@ -688,8 +688,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Identity",
-          "SubSection": "2.2. Conditional Access",
+          "Section": "2 Identity",
+          "SubSection": "2.2 Conditional Access",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "For designated users, they will be prompted to use their multi-factor authentication (MFA) process on logins.",
@@ -709,8 +709,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Identity",
-          "SubSection": "2.2. Conditional Access",
+          "Section": "2 Identity",
+          "SubSection": "2.2 Conditional Access",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Entra ID tracks the behavior of sign-in events. If the Entra ID domain is licensed with P2, the sign-in behavior can be used as a detection mechanism for additional scrutiny during the sign-in event. If this policy is set up, then Risky Sign-in events will prompt users to use multi-factor authentication (MFA) tokens on login for additional verification.",
@@ -732,8 +732,8 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Identity",
-          "SubSection": "2.2. Conditional Access",
+          "Section": "2 Identity",
+          "SubSection": "2.2 Conditional Access",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "This recommendation ensures that users accessing the Windows Azure Service Management API (i.e. Azure Powershell, Azure CLI, Azure Resource Manager API, etc.) are required to use multi-factor authentication (MFA) credentials when accessing resources through the Windows Azure Service Management API.",
@@ -755,8 +755,8 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Identity",
-          "SubSection": "2.2. Conditional Access",
+          "Section": "2 Identity",
+          "SubSection": "2.2 Conditional Access",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "This recommendation ensures that users accessing Microsoft Admin Portals (i.e. Microsoft 365 Admin, Microsoft 365 Defender, Exchange Admin Center, Azure Portal, etc.) are required to use multi-factor authentication (MFA) credentials when logging into an Admin Portal.",
@@ -778,8 +778,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1. Microsoft Defender For Cloud",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the latest OS patches for all virtual machines are applied.",
@@ -801,8 +801,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1. Microsoft Defender For Cloud",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "The Microsoft Cloud Security Benchmark (or 'MCSB') is an Azure Policy Initiative containing many security policies to evaluate resource configuration against best practice recommendations. If a policy in the MCSB is set with effect type `Disabled`, it is not evaluated and may prevent administrators from being informed of valuable security recommendations.",
@@ -824,8 +824,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1. Microsoft Defender For Cloud",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enable security alert emails to subscription owners.",
@@ -847,8 +847,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1. Microsoft Defender For Cloud",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Microsoft Defender for Cloud emails the subscription owners whenever a high-severity alert is triggered for their subscription. You should provide a security contact email address as an additional email address.",
@@ -870,8 +870,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1. Microsoft Defender For Cloud",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enables emailing security alerts to the subscription owner or other designated security contact.",
@@ -891,8 +891,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1. Microsoft Defender For Cloud",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "An organization's attack surface is the collection of assets with a public network identifier or URI that an external threat actor can see or access from outside your cloud. It is the set of points on the boundary of a system, a system element, system component, or an environment where an attacker can try to enter, cause an effect on, or extract data from, that system, system element, system component, or environment. The larger the attack surface, the harder it is to protect.This tool can be configured to scan your organization's online infrastructure such as specified domains, hosts, CIDR blocks, and SSL certificates, and store them in an Inventory. Inventory items can be added, reviewed, approved, and removed, and may contain enrichments ('insights') and additional information collected from the tool's different scan engines and open-source intelligence sources.A Defender EASM workspace will generate an Inventory of publicly exposed assets by crawling and scanning the internet using _Seeds_ you provide when setting up the tool. Seeds can be FQDNs, IP CIDR blocks, and WHOIS records.Defender EASM will generate Insights within 24-48 hours after Seeds are provided, and these insights include vulnerability data (CVEs), ports and protocols, and weak or expired SSL certificates that could be used by an attacker for reconnaisance or exploitation.Results are classified High/Medium/Low and some of them include proposed mitigations.",
@@ -914,8 +914,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1. Microsoft Defender For Cloud",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "[**NOTE:** As of August 1, 2023 customers with an existing subscription to Defender for DNS can continue to use the service, but new subscribers will receive alerts about suspicious DNS activity as part of Defender for Servers P2.]Microsoft Defender for DNS scans all network traffic exiting from within a subscription.",
@@ -937,8 +937,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1.1 Microsoft Cloud Security Posture Management (CSPM)",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enable automatic provisioning of the monitoring agent to collect security data.**DEPRECATION PLANNED:** The Log Analytics Agent is slated for deprecation in August 2024. The Microsoft Defender for Endpoint agent, in tandem with new agentless capabilities will be providing replacement functionality. More detail is available here: [https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/microsoft-defender-for-cloud-strategy-and-plan-towards-log/ba-p/3883341](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/microsoft-defender-for-cloud-strategy-and-plan-towards-log/ba-p/3883341).",
@@ -960,8 +960,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1.1 Microsoft Cloud Security Posture Management (CSPM)",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "This integration setting enables Microsoft Defender for Cloud Apps (formerly 'Microsoft Cloud App Security' or 'MCAS' - see additional info) to communicate with Microsoft Defender for Cloud.",
@@ -983,8 +983,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1.3. Defender Plan: Servers",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Turning on Microsoft Defender for Servers enables threat detection for Servers, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.",
@@ -1006,8 +1006,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1.3. Defender Plan: Servers",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Enable vulnerability assessment for machines on both Azure and hybrid (Arc enabled) machines.",
@@ -1027,8 +1027,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1.3. Defender Plan: Servers",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "The Endpoint protection component enables Microsoft Defender for Endpoint (formerly 'Advanced Threat Protection' or 'ATP' or 'WDATP' - see additional info) to communicate with Microsoft Defender for Cloud.**IMPORTANT:** When enabling integration between DfE & DfC it needs to be taken into account that this will have some side effects that may be undesirable.1. For server 2019 & above if defender is installed (default for these server SKUs) this will trigger a deployment of the new unified agent and link to any of the extended configuration in the Defender portal.1. If the new unified agent is required for server SKUs of Win 2016 or Linux and lower there is additional integration that needs to be switched on and agents need to be aligned.",
@@ -1048,8 +1048,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1.3. Defender Plan: Servers",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Using disk snapshots, the agentless scanner scans for installed software, vulnerabilities, and plain text secrets.",
@@ -1069,8 +1069,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1.3. Defender Plan: Servers",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "File Integrity Monitoring (FIM) is a feature that monitors critical system files in Windows or Linux for potential signs of attack or compromise.",
@@ -1092,8 +1092,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1.4. Defender Plan: Containers",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Turning on Microsoft Defender for Containers enables threat detection for Container Registries including Kubernetes, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud. The following services will be enabled for container instances:- Defender agent in Azure- Azure Policy for Kubernetes- Agentless discovery for Kubernetes- Agentless container vulnerability assessment",
@@ -1113,8 +1113,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1.4. Defender Plan: Containers",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Enable automatic discovery and configuration scanning of the Microsoft Kubernetes clusters.",
@@ -1134,8 +1134,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1.4. Defender Plan: Containers",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Enable automatic vulnerability management for images stored in ACR or running in AKS clusters.",
@@ -1157,8 +1157,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1.5. Defender Plan: Storage",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Turning on Microsoft Defender for Storage enables threat detection for Storage, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.",
@@ -1180,8 +1180,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1.6. Defender Plan: App Service",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Turning on Microsoft Defender for App Service enables threat detection for App Service, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.",
@@ -1203,8 +1203,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1.7. Defender Plan: Databases",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Microsoft Defender for Azure Cosmos DB scans all incoming network requests for threats to your Azure Cosmos DB resources.",
@@ -1226,8 +1226,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1.7. Defender Plan: Databases",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Turning on Microsoft Defender for Open-source relational databases enables threat detection for Open-source relational databases, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.",
@@ -1249,8 +1249,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1.7. Defender Plan: Databases",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Turning on Microsoft Defender for Azure SQL Databases enables threat detection for Managed Instance Azure SQL databases, providing threat intelligence, anomaly detection, and behavior analytics in Microsoft Defender for Cloud.",
@@ -1272,8 +1272,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1.7. Defender Plan: Databases",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Turning on Microsoft Defender for SQL servers on machines enables threat detection for SQL servers on machines, providing threat intelligence, anomaly detection, and behavior analytics in Microsoft Defender for Cloud.",
@@ -1295,8 +1295,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1.8. Defender Plan: Key Vault",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Turning on Microsoft Defender for Key Vault enables threat detection for Key Vault, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.",
@@ -1318,8 +1318,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.1.9. Defender Plan: Resource Manager",
+          "Section": "3 Security",
+          "SubSection": "3.1 Microsoft Defender For Cloud",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Microsoft Defender for Resource Manager scans incoming administrative requests to change your infrastructure from both CLI and the Azure portal.",
@@ -1341,8 +1341,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.2. Microsoft Defender for IoT",
+          "Section": "3 Security",
+          "SubSection": "3.2 Microsoft Defender for IoT",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Microsoft Defender for IoT acts as a central security hub for IoT devices within your organization.",
@@ -1364,8 +1364,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.3. Key Vault",
+          "Section": "3 Security",
+          "SubSection": "3.3 Key Vault",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that all Keys in Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.",
@@ -1387,8 +1387,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.3. Key Vault",
+          "Section": "3 Security",
+          "SubSection": "3.3 Key Vault",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that all Keys in Non Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.",
@@ -1410,8 +1410,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.3. Key Vault",
+          "Section": "3 Security",
+          "SubSection": "3.3 Key Vault",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that all Secrets in Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.",
@@ -1433,8 +1433,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.3. Key Vault",
+          "Section": "3 Security",
+          "SubSection": "3.3 Key Vault",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that all Secrets in Non Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.",
@@ -1456,8 +1456,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.3. Key Vault",
+          "Section": "3 Security",
+          "SubSection": "3.3 Key Vault",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The Key Vault contains object keys, secrets, and certificates. Accidental unavailability of a Key Vault can cause immediate data loss or loss of security functions (authentication, validation, verification, non-repudiation, etc.) supported by the Key Vault objects.It is recommended the Key Vault be made recoverable by enabling the 'Do Not Purge' and 'Soft Delete' functions. This is in order to prevent loss of encrypted data, including storage accounts, SQL databases, and/or dependent services provided by Key Vault objects (Keys, Secrets, Certificates) etc. This may happen in the case of accidental deletion by a user or from disruptive activity by a malicious user.**NOTE:** In February 2025, Microsoft will enable soft-delete protection on all key vaults, and users will no longer be able to opt out of or turn off soft-delete. **WARNING:** A current limitation is that role assignments disappearing when Key Vault is deleted. All role assignments will need to be recreated after recovery.",
@@ -1479,8 +1479,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.3. Key Vault",
+          "Section": "3 Security",
+          "SubSection": "3.3 Key Vault",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "The recommended way to access Key Vaults is to use the Azure Role-Based Access Control (RBAC) permissions model.Azure RBAC is an authorization system built on Azure Resource Manager that provides fine-grained access management of Azure resources. It allows users to manage Key, Secret, and Certificate permissions. It provides one place to manage all permissions across all key vaults.",
@@ -1502,8 +1502,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.3. Key Vault",
+          "Section": "3 Security",
+          "SubSection": "3.3 Key Vault",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Private endpoints will secure network traffic from Azure Key Vault to the resources requesting secrets and keys.",
@@ -1525,8 +1525,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Security",
-          "SubSection": "3.3. Key Vault",
+          "Section": "3 Security",
+          "SubSection": "3.3 Key Vault",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Automatic Key Rotation is available in Public Preview. The currently supported applications are Key Vault, Managed Disks, and Storage accounts accessing keys within Key Vault. The number of supported applications will incrementally increased.",
@@ -1548,7 +1548,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Storage Accounts",
+          "Section": "4 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enable data encryption in transit.",
@@ -1568,7 +1568,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Storage Accounts",
+          "Section": "4 Storage Accounts",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Enabling encryption at the hardware level on top of the default software encryption for Storage Accounts accessing Azure storage solutions.",
@@ -1590,7 +1590,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Storage Accounts",
+          "Section": "4 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Access Keys authenticate application access requests to data contained in Storage Accounts. A periodic rotation of these keys is recommended to ensure that potentially compromised keys cannot result in a long-term exploitable credential. The 'Rotation Reminder' is an automatic reminder feature for a manual procedure.",
@@ -1612,7 +1612,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Storage Accounts",
+          "Section": "4 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "For increased security, regenerate storage account access keys periodically.",
@@ -1632,7 +1632,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Storage Accounts",
+          "Section": "4 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Expire shared access signature tokens within an hour.",
@@ -1654,7 +1654,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Storage Accounts",
+          "Section": "4 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Disallowing public network access for a storage account overrides the public access settings for individual containers in that storage account for Azure Resource Manager Deployment Model storage accounts. Azure Storage accounts that use the classic deployment model will be retired on August 31, 2024.",
@@ -1676,7 +1676,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Storage Accounts",
+          "Section": "4 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Restricting default network access helps to provide a new layer of security, since storage accounts accept connections from clients on any network. To limit access to selected networks, the default action must be changed.",
@@ -1698,7 +1698,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Storage Accounts",
+          "Section": "4 Storage Accounts",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "_NOTE:_ This recommendation assumes that the `Public network access` parameter is set to `Enabled from selected virtual networks and IP addresses`. Please ensure the prerequisite recommendation has been implemented before proceeding: - Ensure Default Network Access Rule for Storage Accounts is Set to DenySome Azure services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Azure services to bypass the network rules. These services will then use strong authentication to access the storage account. If the `Allow Azure services on the trusted services list to access this storage account` exception is enabled, the following services are granted access to the storage account: Azure Backup, Azure Data Box, Azure DevTest Labs, Azure Event Grid, Azure Event Hubs, Azure File Sync, Azure HDInsight, Azure Import/Export, Azure Monitor, Azure Networking Services, and Azure Site Recovery (when registered in the subscription).",
@@ -1720,7 +1720,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Storage Accounts",
+          "Section": "4 Storage Accounts",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Use private endpoints for your Azure Storage accounts to allow clients and services to securely access data located over a network via an encrypted Private Link. To do this, the private endpoint uses an IP address from the VNet for each service. Network traffic between disparate services securely traverses encrypted over the VNet. This VNet can also link addressing space, extending your network and accessing resources on it. Similarly, it can be a tunnel through public networks to connect remote infrastructures together. This creates further security through segmenting network traffic and preventing outside sources from accessing it.",
@@ -1742,7 +1742,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Storage Accounts",
+          "Section": "4 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The Azure Storage blobs contain data like ePHI or Financial, which can be secret or personal. Data that is erroneously modified or deleted by an application or other storage account user will cause data loss or unavailability.It is recommended that both Azure Containers with attached Blob Storage and standalone containers with Blob Storage be made recoverable by enabling the **soft delete** configuration. This is to save and recover data when blobs or blob snapshots are deleted.",
@@ -1764,7 +1764,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Storage Accounts",
+          "Section": "4 Storage Accounts",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Enable sensitive data encryption at rest using Customer Managed Keys (CMK) rather than Microsoft Managed keys.",
@@ -1784,7 +1784,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Storage Accounts",
+          "Section": "4 Storage Accounts",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "The Storage Queue service stores messages that may be read by any client who has access to the storage account. A queue can contain an unlimited number of messages, each of which can be up to 64KB in size using version 2011-08-18 or newer. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the queues. Storage Logging log entries contain the following information about individual requests: Timing information such as start time, end-to-end latency, and server latency, authentication details, concurrency information, and the sizes of the request and response messages.",
@@ -1804,7 +1804,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Storage Accounts",
+          "Section": "4 Storage Accounts",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "The Storage Blob service provides scalable, cost-efficient object storage in the cloud. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the blobs. Storage Logging log entries contain the following information about individual requests: timing information such as start time, end-to-end latency, and server latency; authentication details; concurrency information; and the sizes of the request and response messages.",
@@ -1824,7 +1824,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Storage Accounts",
+          "Section": "4 Storage Accounts",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Azure Table storage is a service that stores structured NoSQL data in the cloud, providing a key/attribute store with a schema-less design. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the tables. Storage Logging log entries contain the following information about individual requests: timing information such as start time, end-to-end latency, and server latency; authentication details; concurrency information; and the sizes of the request and response messages.",
@@ -1846,7 +1846,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Storage Accounts",
+          "Section": "4 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "In some cases, Azure Storage sets the minimum TLS version to be version 1.0 by default. TLS 1.0 is a legacy version and has known vulnerabilities. This minimum TLS version can be configured to be later protocols such as TLS 1.2.",
@@ -1866,7 +1866,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Storage Accounts",
+          "Section": "4 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Cross Tenant Replication in Azure allows data to be replicated across multiple Azure tenants. While this feature can be beneficial for data sharing and availability, it also poses a significant security risk if not properly managed. Unauthorized data access, data leakage, and compliance violations are potential risks. Disabling Cross Tenant Replication ensures that data is not inadvertently replicated across different tenant boundaries without explicit authorization.",
@@ -1886,7 +1886,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Storage Accounts",
+          "Section": "4 Storage Accounts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The Azure Storage setting ‘Allow Blob Anonymous Access’ (aka 'allowBlobPublicAccess') controls whether anonymous access is allowed for blob data in a storage account. When this property is set to True, it enables public read access to blob data, which can be convenient for sharing data but may carry security risks. When set to False, it disallows public access to blob data, providing a more secure storage environment.",
@@ -1908,8 +1908,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.1. Azure SQL Database",
+          "Section": "5 Database Services",
+          "SubSection": "5.1 Azure SQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enable auditing on SQL Servers.",
@@ -1931,8 +1931,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.1. Azure SQL Database",
+          "Section": "5 Database Services",
+          "SubSection": "5.1 Azure SQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP).",
@@ -1954,8 +1954,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.1. Azure SQL Database",
+          "Section": "5 Database Services",
+          "SubSection": "5.1 Azure SQL Database",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Transparent Data Encryption (TDE) with Customer-managed key support provides increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties.With TDE, data is encrypted at rest with a symmetric key (called the database encryption key) stored in the database or data warehouse distribution. To protect this data encryption key (DEK) in the past, only a certificate that the Azure SQL Service managed could be used. Now, with Customer-managed key support for TDE, the DEK can be protected with an asymmetric key that is stored in the Azure Key Vault. The Azure Key Vault is a highly available and scalable cloud-based key store which offers central key management, leverages FIPS 140-2 Level 2 validated hardware security modules (HSMs), and allows separation of management of keys and data for additional security.Based on business needs or criticality of data/databases hosted on a SQL server, it is recommended that the TDE protector is encrypted by a key that is managed by the data owner (Customer-managed key).",
@@ -1977,8 +1977,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.1. Azure SQL Database",
+          "Section": "5 Database Services",
+          "SubSection": "5.1 Azure SQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Use Microsoft Entra authentication for authentication with SQL Database to manage credentials in a single place.",
@@ -2000,8 +2000,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.1. Azure SQL Database",
+          "Section": "5 Database Services",
+          "SubSection": "5.1 Azure SQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enable Transparent Data Encryption on every SQL server.",
@@ -2023,8 +2023,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.1. Azure SQL Database",
+          "Section": "5 Database Services",
+          "SubSection": "5.1 Azure SQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "SQL Server Audit Retention should be configured to be greater than 90 days.",
@@ -2044,8 +2044,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.1. Azure SQL Database",
+          "Section": "5 Database Services",
+          "SubSection": "5.1 Azure SQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Disabling public network access restricts the service from accessing public networks.",
@@ -2067,8 +2067,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.2. Azure SQL Database for PostgreSQL",
+          "Section": "5 Database Services",
+          "SubSection": "5.2 Azure SQL Database for PostgreSQL",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enable `require_secure_transport` on `PostgreSQL flexible servers`.",
@@ -2090,8 +2090,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.2. Azure SQL Database for PostgreSQL",
+          "Section": "5 Database Services",
+          "SubSection": "5.2 Azure SQL Database for PostgreSQL",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enable `log_checkpoints` on `PostgreSQL flexible servers`.",
@@ -2113,8 +2113,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.2. Azure SQL Database for PostgreSQL",
+          "Section": "5 Database Services",
+          "SubSection": "5.2 Azure SQL Database for PostgreSQL",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enable connection throttling on `PostgreSQL flexible servers`.",
@@ -2136,8 +2136,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.2. Azure SQL Database for PostgreSQL",
+          "Section": "5 Database Services",
+          "SubSection": "5.2 Azure SQL Database for PostgreSQL",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Ensure `logfiles.retention_days` on `PostgreSQL flexible servers` is set to an appropriate value.",
@@ -2159,8 +2159,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.2. Azure SQL Database for PostgreSQL",
+          "Section": "5 Database Services",
+          "SubSection": "5.2 Azure SQL Database for PostgreSQL",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Disable access from Azure services to `PostgreSQL flexible server`.",
@@ -2182,8 +2182,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.2. Azure SQL Database for PostgreSQL",
+          "Section": "5 Database Services",
+          "SubSection": "5.2 Azure SQL Database for PostgreSQL",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enable `log_connections` on `PostgreSQL single servers`.**NOTE:** This recommendation currently only applies to Single Server, not Flexible Server. See additional information below for details about the planned retirement of Azure PostgreSQL Single Server.",
@@ -2205,8 +2205,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.2. Azure SQL Database for PostgreSQL",
+          "Section": "5 Database Services",
+          "SubSection": "5.2 Azure SQL Database for PostgreSQL",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enable `log_disconnections` on `PostgreSQL Servers`.**NOTE:** This recommendation currently only applies to Single Server, not Flexible Server. See additional information below for details about the planned retirement of Azure PostgreSQL Single Server.",
@@ -2226,8 +2226,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.2. Azure SQL Database for PostgreSQL",
+          "Section": "5 Database Services",
+          "SubSection": "5.2 Azure SQL Database for PostgreSQL",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Azure Database for PostgreSQL servers should be created with 'infrastructure double encryption' enabled.**NOTE:** This recommendation currently only applies to Single Server, not Flexible Server. See additional information below for details about the planned retirement of Azure PostgreSQL Single Server.",
@@ -2249,8 +2249,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.3. Azure for MySQL",
+          "Section": "5 Database Services",
+          "SubSection": "5.3 Azure for MySQL",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enable `require_secure_transport` on `MySQL flexible servers`.",
@@ -2270,8 +2270,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.3. Azure for MySQL",
+          "Section": "5 Database Services",
+          "SubSection": "5.3 Azure for MySQL",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Ensure `tls_version` on `MySQL flexible servers` is set to use TLS version 1.2 or higher.",
@@ -2293,8 +2293,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.3. Azure for MySQL",
+          "Section": "5 Database Services",
+          "SubSection": "5.3 Azure for MySQL",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Enable `audit_log_enabled` on `MySQL flexible servers`.",
@@ -2316,8 +2316,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.3. Azure for MySQL",
+          "Section": "5 Database Services",
+          "SubSection": "5.3 Azure for MySQL",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Set `audit_log_events` to include `CONNECTION` on `MySQL flexible servers`.",
@@ -2339,8 +2339,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.4. Azure Cosmos DB",
+          "Section": "5 Database Services",
+          "SubSection": "5.4 Azure Cosmos DB",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Limiting your Cosmos DB to only communicate on whitelisted networks lowers its attack footprint.",
@@ -2362,8 +2362,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.4. Azure Cosmos DB",
+          "Section": "5 Database Services",
+          "SubSection": "5.4 Azure Cosmos DB",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Private endpoints limit network traffic to approved sources.",
@@ -2385,8 +2385,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Database Services",
-          "SubSection": "5.4. Azure Cosmos DB",
+          "Section": "5 Database Services",
+          "SubSection": "5.4 Azure Cosmos DB",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Cosmos DB can use tokens or Entra ID for client authentication which in turn will use Azure RBAC for authorization. Using Entra ID is significantly more secure because Entra ID handles the credentials and allows for MFA and centralized management, and the Azure RBAC is better integrated with the rest of Azure.",
@@ -2406,7 +2406,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "6. Logging and Monitoring",
+          "Section": "6 Logging and Monitoring",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Resource Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself; for example, reading or updating a secret from a Key Vault. Currently, 95 Azure resources support Azure Monitoring (See the more information section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps, and CosmosDB. The content of these logs varies by resource type.A number of back-end services were not configured to log and store Resource Logs for certain activities or for a sufficient length. It is crucial that monitoring is correctly configured to log all relevant activities and retain those logs for a sufficient length of time. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.",
@@ -2426,7 +2426,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "6. Logging and Monitoring",
+          "Section": "6 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "The use of Basic or Free SKUs in Azure whilst cost effective have significant limitations in terms of what can be monitored and what support can be realized from Microsoft. Typically, these SKU’s do not have a service SLA and Microsoft may refuse to provide support for them. Consequently Basic/Free SKUs should never be used for production workloads.",
@@ -2448,8 +2448,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Logging and Monitoring",
-          "SubSection": "6.1. Configuring Diagnostic Settings",
+          "Section": "6 Logging and Monitoring",
+          "SubSection": "6.1 Configuring Diagnostic Settings",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Enable Diagnostic settings for exporting activity logs.Diagnostic settings are available for each individual resource within a subscription. Settings should be configured for all appropriate resources for your environment.",
@@ -2471,8 +2471,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Logging and Monitoring",
-          "SubSection": "6.1. Configuring Diagnostic Settings",
+          "Section": "6 Logging and Monitoring",
+          "SubSection": "6.1 Configuring Diagnostic Settings",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "**Prerequisite**: A Diagnostic Setting must exist. If a Diagnostic Setting does not exist, the navigation and options within this recommendation will not be available. Please review the recommendation at the beginning of this subsection titled: 'Ensure that a 'Diagnostic Setting' exists.'The diagnostic setting should be configured to log the appropriate activities from the control/management plane.",
@@ -2494,8 +2494,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Logging and Monitoring",
-          "SubSection": "6.1. Configuring Diagnostic Settings",
+          "Section": "6 Logging and Monitoring",
+          "SubSection": "6.1 Configuring Diagnostic Settings",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Storage accounts with the activity log exports can be configured to use Customer Managed Keys (CMK).",
@@ -2517,8 +2517,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Logging and Monitoring",
-          "SubSection": "6.1. Configuring Diagnostic Settings",
+          "Section": "6 Logging and Monitoring",
+          "SubSection": "6.1 Configuring Diagnostic Settings",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enable AuditEvent logging for key vault instances to ensure interactions with key vaults are logged and available.",
@@ -2540,8 +2540,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Logging and Monitoring",
-          "SubSection": "6.1. Configuring Diagnostic Settings",
+          "Section": "6 Logging and Monitoring",
+          "SubSection": "6.1 Configuring Diagnostic Settings",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Ensure that network flow logs are captured and fed into a central log analytics workspace.",
@@ -2563,8 +2563,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Logging and Monitoring",
-          "SubSection": "6.1. Configuring Diagnostic Settings",
+          "Section": "6 Logging and Monitoring",
+          "SubSection": "6.1 Configuring Diagnostic Settings",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Enable AppServiceHTTPLogs diagnostic log category for Azure App Service instances to ensure all http requests are captured and centrally logged.",
@@ -2586,8 +2586,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Logging and Monitoring",
-          "SubSection": "6.2. Monitoring using Activity Log Alerts",
+          "Section": "6 Logging and Monitoring",
+          "SubSection": "6.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Create an activity log alert for the Create Policy Assignment event.",
@@ -2609,8 +2609,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Logging and Monitoring",
-          "SubSection": "6.2. Monitoring using Activity Log Alerts",
+          "Section": "6 Logging and Monitoring",
+          "SubSection": "6.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Create an activity log alert for the Delete Policy Assignment event.",
@@ -2632,8 +2632,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Logging and Monitoring",
-          "SubSection": "6.2. Monitoring using Activity Log Alerts",
+          "Section": "6 Logging and Monitoring",
+          "SubSection": "6.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Create an Activity Log Alert for the Create or Update Network Security Group event.",
@@ -2655,8 +2655,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Logging and Monitoring",
-          "SubSection": "6.2. Monitoring using Activity Log Alerts",
+          "Section": "6 Logging and Monitoring",
+          "SubSection": "6.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Create an activity log alert for the Delete Network Security Group event.",
@@ -2678,8 +2678,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Logging and Monitoring",
-          "SubSection": "6.2. Monitoring using Activity Log Alerts",
+          "Section": "6 Logging and Monitoring",
+          "SubSection": "6.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Create an activity log alert for the Create or Update Security Solution event.",
@@ -2701,8 +2701,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Logging and Monitoring",
-          "SubSection": "6.2. Monitoring using Activity Log Alerts",
+          "Section": "6 Logging and Monitoring",
+          "SubSection": "6.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Create an activity log alert for the Delete Security Solution event.",
@@ -2724,8 +2724,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Logging and Monitoring",
-          "SubSection": "6.2. Monitoring using Activity Log Alerts",
+          "Section": "6 Logging and Monitoring",
+          "SubSection": "6.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Create an activity log alert for the Create or Update SQL Server Firewall Rule event.",
@@ -2747,8 +2747,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Logging and Monitoring",
-          "SubSection": "6.2. Monitoring using Activity Log Alerts",
+          "Section": "6 Logging and Monitoring",
+          "SubSection": "6.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Create an activity log alert for the 'Delete SQL Server Firewall Rule.",
@@ -2770,8 +2770,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Logging and Monitoring",
-          "SubSection": "6.2. Monitoring using Activity Log Alerts",
+          "Section": "6 Logging and Monitoring",
+          "SubSection": "6.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Create an activity log alert for the Create or Update Public IP Addresses rule.",
@@ -2793,8 +2793,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Logging and Monitoring",
-          "SubSection": "6.2. Monitoring using Activity Log Alerts",
+          "Section": "6 Logging and Monitoring",
+          "SubSection": "6.2 Monitoring using Activity Log Alerts",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Create an activity log alert for the Delete Public IP Address rule.",
@@ -2816,7 +2816,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Logging and Monitoring",
+          "Section": "6 Logging and Monitoring",
           "SubSection": "6.3. Configuring Application Insights",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
@@ -2839,7 +2839,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. Networking",
+          "Section": "7 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required.",
@@ -2861,7 +2861,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. Networking",
+          "Section": "7 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required.",
@@ -2883,7 +2883,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. Networking",
+          "Section": "7 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required.",
@@ -2905,7 +2905,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. Networking",
+          "Section": "7 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required and narrowly configured.",
@@ -2927,7 +2927,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. Networking",
+          "Section": "7 Networking",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Network Security Group Flow Logs should be enabled and the retention period set to greater than or equal to 90 days.",
@@ -2949,7 +2949,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. Networking",
+          "Section": "7 Networking",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Enable Network Watcher for physical regions in Azure subscriptions.",
@@ -2969,7 +2969,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "7. Networking",
+          "Section": "7 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Public IP Addresses provide tenant accounts with Internet connectivity for resources contained within the tenant. During the creation of certain resources in Azure, a Public IP Address may be created. All Public IP Addresses within the tenant should be periodically reviewed for accuracy and necessity.",
@@ -2991,7 +2991,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Virtual Machines",
+          "Section": "8 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "The Azure Bastion service allows secure remote access to Azure Virtual Machines over the Internet without exposing remote access protocol ports and services directly to the Internet. The Azure Bastion service provides this access using TLS over 443/TCP, and subscribes to hardened configurations within an organization's Azure Active Directory service.",
@@ -3013,7 +3013,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Virtual Machines",
+          "Section": "8 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Migrate blob-based VHDs to Managed Disks on Virtual Machines to exploit the default features of this configuration.The features include: 1) Default Disk Encryption2) Resilience, as Microsoft will managed the disk storage and move around if underlying hardware goes faulty3) Reduction of costs over storage accounts",
@@ -3035,7 +3035,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Virtual Machines",
+          "Section": "8 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that OS disks (boot volumes) and data disks (non-boot volumes) are encrypted with CMK (Customer Managed Keys).Customer Managed keys can be either ADE or Server Side Encryption (SSE).",
@@ -3057,7 +3057,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Virtual Machines",
+          "Section": "8 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that unattached disks in a subscription are encrypted with a Customer Managed Key (CMK).",
@@ -3077,7 +3077,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "8. Virtual Machines",
+          "Section": "8 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Virtual Machine Disks and snapshots can be configured to allow access from different network resources.",
@@ -3097,7 +3097,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "8. Virtual Machines",
+          "Section": "8 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Data Access Authentication Mode provides a method of uploading or exporting Virtual Machine Disks.",
@@ -3117,7 +3117,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "8. Virtual Machines",
+          "Section": "8 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "For added security, only install organization-approved extensions on VMs.",
@@ -3139,7 +3139,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Virtual Machines",
+          "Section": "8 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Install endpoint protection for all virtual machines.",
@@ -3159,7 +3159,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "8. Virtual Machines",
+          "Section": "8 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "**NOTE: This is a legacy recommendation. Managed Disks are encrypted by default and recommended for all new VM implementations.**VHD (Virtual Hard Disks) are stored in blob storage and are the old-style disks that were attached to Virtual Machines. The blob VHD was then leased to the VM. By default, storage accounts are not encrypted, and Microsoft Defender will then recommend that the OS disks should be encrypted. Storage accounts can be encrypted as a whole using PMK or CMK. This should be turned on for storage accounts containing VHDs.",
@@ -3181,7 +3181,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Virtual Machines",
+          "Section": "8 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Verify identities without MFA that can log in to a privileged virtual machine using separate login credentials. An adversary can leverage the access to move laterally and perform actions with the virtual machine's managed identity. Make sure the virtual machine only has necessary permissions, and revoke the admin-level permissions according to the least privileges principal",
@@ -3203,7 +3203,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Virtual Machines",
+          "Section": "8 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "When **Secure Boot** and **vTPM** are enabled together, they provide a strong foundation for protecting your VM from boot attacks. For example, if an attacker attempts to replace the bootloader with a malicious version, Secure Boot will prevent the VM from booting. If the attacker is able to bypass Secure Boot and install a malicious bootloader, vTPM can be used to detect the intrusion and alert you.",
@@ -3225,7 +3225,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Azure App Service allows apps to run under both HTTP and HTTPS by default. Apps can be accessed by anyone using non-secure HTTP links by default. Non-secure HTTP requests can be restricted and all HTTP requests redirected to the secure HTTPS port. It is recommended to enforce HTTPS-only traffic.",
@@ -3247,7 +3247,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Azure App Service Authentication is a feature that can prevent anonymous HTTP requests from reaching a Web Application or authenticate those with tokens before they reach the app. If an anonymous request is received from a browser, App Service will redirect to a logon page. To handle the logon process, a choice from a set of identity providers can be made, or a custom authentication mechanism can be implemented.",
@@ -3269,7 +3269,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "By default, App Services can be deployed over FTP. If FTP is required for an essential deployment workflow, FTPS should be required for FTP login for all App Services.If FTPS is not expressly required for the App, the recommended setting is `Disabled.`",
@@ -3291,7 +3291,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The TLS (Transport Layer Security) protocol secures transmission of data over the internet using standard encryption technology. Encryption should be set with the latest version of TLS. App service allows TLS 1.2 by default, which is the recommended TLS level by industry standards such as PCI DSS.",
@@ -3313,7 +3313,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Managed service identity in App Service provides more security by eliminating secrets from the app, such as credentials in the connection strings. When registering an App Service with Entra ID, the app will connect to other Azure services securely without the need for usernames and passwords.",
@@ -3333,7 +3333,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Basic Authentication provides the ability to create identities and authentication for an App Service without a centralized Identity Provider. For a more effective, capable, and secure solution for Identity, Authentication, Authorization, and Accountability, a centralized Identity Provider such as Entra ID is strongly advised.",
@@ -3355,7 +3355,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Periodically, older versions of PHP may be deprecated and no longer supported. Using a supported version of PHP for app services is recommended to avoid potential unpatched vulnerabilities.",
@@ -3377,7 +3377,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Periodically, older versions of Python may be deprecated and no longer supported. Using a supported version of Python for app services is recommended to avoid potential unpatched vulnerabilities.",
@@ -3399,7 +3399,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Periodically, older versions of Java may be deprecated and no longer supported. Using a supported version of Java for app services is recommended to avoid potential unpatched vulnerabilities.",
@@ -3421,7 +3421,7 @@
       ],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for apps to take advantage of security fixes, if any, and/or new functionalities of the newer version.",
@@ -3441,7 +3441,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Azure Key Vault will store multiple types of sensitive information such as encryption keys, certificate thumbprints, and Managed Identity Credentials. Access to these 'Secrets' can be controlled through granular permissions.",
@@ -3461,7 +3461,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "9. AppService",
+          "Section": "9 AppService",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Remote Debugging allows Azure App Service to be debugged in real-time directly on the Azure environment. When remote debugging is enabled, it opens a communication channel that could potentially be exploited by unauthorized users if not properly secured.",
@@ -3481,7 +3481,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "10. Miscellaneous",
+          "Section": "10 Miscellaneous",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Resource Manager Locks provide a way for administrators to lock down Azure resources to prevent deletion of, or modifications to, a resource. These locks sit outside of the Role Based Access Controls (RBAC) hierarchy and, when applied, will place restrictions on the resource for all users. These locks are very useful when there is an important resource in a subscription that users should not be able to delete or change. Locks can help prevent accidental and malicious changes or deletion.",
diff --git a/prowler/compliance/gcp/cis_2.0_gcp.json b/prowler/compliance/gcp/cis_2.0_gcp.json
index abc6238a09..6ef4d575e4 100644
--- a/prowler/compliance/gcp/cis_2.0_gcp.json
+++ b/prowler/compliance/gcp/cis_2.0_gcp.json
@@ -10,7 +10,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Use corporate login credentials instead of personal accounts, such as Gmail accounts.",
@@ -29,7 +29,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Setup multi-factor authentication for Google Cloud Platform accounts.",
@@ -48,7 +48,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Setup Security Key Enforcement for Google Cloud Platform admin accounts.",
@@ -69,7 +69,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. API keys are always at risk because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API keys to use (call) only APIs required by an application.",
@@ -90,7 +90,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. If they are in use it is recommended to rotate API keys every 90 days.",
@@ -111,7 +111,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. Unused keys with their permissions in tact may still exist within a project. Keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to use standard authentication flow instead.",
@@ -132,7 +132,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that Essential Contacts is configured to designate email addresses for Google Cloud services to notify of important technical or security information.",
@@ -153,7 +153,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Google Cloud Key Management Service stores cryptographic keys in a hierarchical structure designed for useful and elegant access control management.   The format for the rotation schedule depends on the client library that is used. For the gcloud command-line tool, the next rotation time must be in `ISO` or `RFC3339` format, and the rotation period must be in the form `INTEGERUNIT`, where units can be one of seconds (s), minutes (m), hours (h) or days (d).",
@@ -174,7 +174,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that the IAM policy on Cloud KMS `cryptokeys` should restrict anonymous and/or public access.",
@@ -195,7 +195,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "When you use Dataproc, cluster and job data is stored on Persistent Disks (PDs) associated with the Compute Engine VMs in your cluster and in a Cloud Storage staging bucket. This PD and bucket data is encrypted using a Google-generated data encryption key (DEK) and key encryption key (KEK). The CMEK feature allows you to create, use, and revoke the key encryption key (KEK). Google still controls the data encryption key (DEK).",
@@ -216,7 +216,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to assign the `Service Account User (iam.serviceAccountUser)` and `Service Account Token Creator (iam.serviceAccountTokenCreator)` roles to a user for a specific service account rather than assigning the role to a user at project level.",
@@ -237,7 +237,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that the principle of 'Separation of Duties' is enforced while assigning KMS related roles to users.",
@@ -256,7 +256,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. In this case, unrestricted keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API key usage to trusted hosts, HTTP referrers and apps. It is recommended to use the more secure standard authentication flow instead.",
@@ -277,7 +277,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that the principle of 'Separation of Duties' is enforced while assigning service-account related roles to users.",
@@ -298,7 +298,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "A service account is a special Google account that belongs to an application or a VM, instead of to an individual end-user. The application uses the service account to call the service's Google API so that users aren't directly involved. It's recommended not to use admin access for ServiceAccount.",
@@ -319,7 +319,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "User managed service accounts should not have user-managed keys.",
@@ -340,7 +340,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Service Account keys consist of a key ID (Private_key_Id) and Private key, which are used to sign programmatic requests users make to Google cloud services accessible to that particular service account. It is recommended that all Service Account keys are regularly rotated.",
@@ -359,7 +359,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Google Cloud Functions allow you to host serverless code that is executed when an event is triggered, without the requiring the management a host operating system. These functions can also store environment variables to be used by the code that may contain authentication or other information that needs to remain confidential.",
@@ -380,7 +380,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "GCP Access Approval enables you to require your organizations' explicit approval whenever Google support try to access your projects. You can then select users within your organization who can approve these requests through giving them a security role in IAM. All access requests display which Google Employee requested them in an email or Pub/Sub message that you can choose to Approve. This adds an additional control and logging of who in your organization approved/denied these requests.",
@@ -401,7 +401,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "GCP Cloud Asset Inventory is services that provides a historical view of GCP resources and IAM policies through a time-series database. The information recorded includes metadata on Google Cloud resources, metadata on policies set on Google Cloud projects or resources, and runtime information gathered within a Google Cloud resource.",
@@ -422,7 +422,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "In order to prevent unnecessary project ownership assignments to users/service-accounts and further misuses of projects and resources, all `roles/Owner` assignments should be monitored.  Members (users/Service-Accounts) with a role assignment to primitive role `roles/Owner` are project owners.  The project owner has all the privileges on the project the role belongs to. These are summarized below: - All viewer permissions on all GCP Services within the project - Permissions for actions that modify the state of all GCP services within the project - Manage roles and permissions for a project and all resources within the project - Set up billing for a project  Granting the owner role to a member (user/Service-Account) will allow that member to modify the Identity and Access Management (IAM) policy. Therefore, grant the owner role only if the member has a legitimate purpose to manage the IAM policy. This is because the project IAM policy contains sensitive access control data. Having a minimal set of users allowed to manage IAM policy will simplify any auditing that may be necessary.",
@@ -443,7 +443,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Logging enabled on a HTTPS Load Balancer will show all network traffic and its destination.",
@@ -464,7 +464,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that Cloud Audit Logging is configured to track all admin activities and read, write access to user data.",
@@ -485,7 +485,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Cloud DNS logging records the queries from the name servers within your VPC to Stackdriver. Logged queries can come from Compute Engine VMs, GKE containers, or other GCP resources provisioned within the VPC.",
@@ -506,7 +506,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Enabling retention policies on log buckets will protect logs stored in cloud storage buckets from being overwritten or accidentally deleted. It is recommended to set up retention policies and configure Bucket Lock on all storage buckets that are used as log sinks.",
@@ -527,7 +527,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to create a sink that will export copies of all the log entries. This can help aggregate logs from multiple projects and export them to a Security Information and Event Management (SIEM).",
@@ -548,7 +548,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Google Cloud Platform (GCP) services write audit log entries to the Admin Activity and Data Access logs to help answer the questions of, \"who did what, where, and when?\" within GCP projects.  Cloud audit logging records information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by GCP services. Cloud audit logging provides a history of GCP API calls for an account, including API calls made via the console, SDKs, command-line tools, and other GCP services.",
@@ -569,7 +569,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that a metric filter and alarm be established for Cloud Storage Bucket IAM changes.",
@@ -590,7 +590,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that a metric filter and alarm be established for changes to Identity and Access Management (IAM) role creation, deletion and updating activities.",
@@ -611,7 +611,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that a metric filter and alarm be established for SQL instance configuration changes.",
@@ -632,7 +632,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) network changes.",
@@ -651,7 +651,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "GCP Access Transparency provides audit logs for all actions that Google personnel take in your Google Cloud resources.",
@@ -672,7 +672,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) Network Firewall rule changes.",
@@ -693,7 +693,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) network route changes.",
@@ -714,7 +714,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Networking",
+          "Section": "3 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "In order to prevent use of legacy networks, a project should not have a legacy network configured. As of now, Legacy Networks are gradually being phased out, and you can no longer create projects with them. This recommendation is to check older projects to ensure that they are not using Legacy Networks.",
@@ -735,7 +735,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Networking",
+          "Section": "3 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Cloud Domain Name System (DNS) is a fast, reliable and cost-effective domain name system that powers millions of domains on the internet. Domain Name System Security Extensions (DNSSEC) in Cloud DNS enables domain owners to take easy steps to protect their domains against DNS hijacking and man-in-the-middle and other attacks.",
@@ -756,7 +756,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Networking",
+          "Section": "3 Networking",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "GCP `Firewall Rules` are specific to a `VPC Network`. Each rule either `allows` or `denies` traffic when its conditions are met. Its conditions allow users to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances.  Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, an `IPv4` address or `IPv4 block in CIDR` notation can be used. Generic `(0.0.0.0/0)` incoming traffic from the Internet to a VPC or VM instance using `RDP` on `Port 3389` can be avoided.",
@@ -777,7 +777,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Networking",
+          "Section": "3 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract.  DNSSEC algorithm numbers in this registry may be used in CERT RRs. Zone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. The algorithm used for key signing should be a recommended one and it should be strong.",
@@ -798,7 +798,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Networking",
+          "Section": "3 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract.  DNSSEC algorithm numbers in this registry may be used in CERT RRs. Zone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. The algorithm used for key signing should be a recommended one and it should be strong.",
@@ -819,7 +819,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Networking",
+          "Section": "3 Networking",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "GCP `Firewall Rules` are specific to a `VPC Network`. Each rule either `allows` or `denies` traffic when its conditions are met. Its conditions allow the user to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances.  Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, only an `IPv4` address or `IPv4 block in CIDR` notation can be used. Generic `(0.0.0.0/0)` incoming traffic from the internet to VPC or VM instance using `SSH` on `Port 22` can be avoided.",
@@ -840,7 +840,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Networking",
+          "Section": "3 Networking",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "To prevent use of `default` network, a project should not have a `default` network.",
@@ -861,7 +861,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Networking",
+          "Section": "3 Networking",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Flow Logs is a feature that enables users to capture information about the IP traffic going to and from network interfaces in the organization's VPC Subnets. Once a flow log is created, the user can view and retrieve its data in Stackdriver Logging. It is recommended that Flow Logs be enabled for every business-critical VPC subnet.",
@@ -880,7 +880,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Networking",
+          "Section": "3 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Secure Sockets Layer (SSL) policies determine what port Transport Layer Security (TLS) features clients are permitted to use when connecting to load balancers. To prevent usage of insecure features, SSL policies should use (a) at least TLS 1.2 with the MODERN profile; or (b) the RESTRICTED profile, because it effectively requires clients to use TLS 1.2 regardless of the chosen minimum TLS version; or (3) a CUSTOM profile that does not support any of the following features:  ``` TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA ```",
@@ -899,7 +899,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Networking",
+          "Section": "3 Networking",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "IAP authenticates the user requests to your apps via a Google single sign in. You can then manage these users with permissions to control access. It is recommended to use both IAP permissions and firewalls to restrict this access to your apps with sensitive information.",
@@ -920,7 +920,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Interacting with a serial port is often referred to as the serial console, which is similar to using a terminal window, in that input and output is entirely in text mode and there is no graphical interface or mouse support.  If you enable the interactive serial console on an instance, clients can attempt to connect to that instance from any IP address. Therefore interactive serial console support should be disabled.",
@@ -941,7 +941,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to use Instance specific SSH key(s) instead of using common/shared project-wide SSH key(s) to access Instances.",
@@ -962,7 +962,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "To defend against advanced threats and ensure that the boot loader and firmware on your VMs are signed and untampered, it is recommended that Compute instances are launched with Shielded VM enabled.",
@@ -983,7 +983,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enabling OS login binds SSH certificates to IAM users and facilitates effective SSH certificate management.",
@@ -1004,7 +1004,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Compute instances should not be configured to have external IP addresses.",
@@ -1025,7 +1025,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Google Cloud encrypts data at-rest and in-transit, but customer data must be decrypted for processing. Confidential Computing is a breakthrough technology which encrypts data in-use—while it is being processed. Confidential Computing environments keep data encrypted in memory and elsewhere outside the central processing unit (CPU).   Confidential VMs leverage the Secure Encrypted Virtualization (SEV) feature of AMD EPYC™ CPUs. Customer data will stay encrypted while it is used, indexed, queried, or trained on. Encryption keys are generated in hardware, per VM, and not exportable. Thanks to built-in hardware optimizations of both performance and security, there is no significant performance penalty to Confidential Computing workloads.",
@@ -1046,7 +1046,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to configure your instance to not use the default Compute Engine service account because it has the Editor role on the project.",
@@ -1067,7 +1067,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "To support principle of least privileges and prevent potential privilege escalation it is recommended that instances are not assigned to default service account `Compute Engine default service account` with Scope `Allow full access to all Cloud APIs`.",
@@ -1088,7 +1088,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets.  Forwarding of data packets should be disabled to prevent data loss or information disclosure.",
@@ -1107,7 +1107,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "In order to maintain the highest level of security all connections to an application should be secure by default.",
@@ -1128,7 +1128,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Customer-Supplied Encryption Keys (CSEK) are a feature in Google Cloud Storage and Google Compute Engine. If you supply your own encryption keys, Google uses your key to protect the Google-generated keys used to encrypt and decrypt your data. By default, Google Compute Engine encrypts all data at rest. Compute Engine handles and manages this encryption for you without any additional actions on your part. However, if you wanted to control and manage this encryption yourself, you can provide your own encryption keys.",
@@ -1147,7 +1147,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Google Cloud Virtual Machines have the ability via an OS Config agent API to periodically (about every 10 minutes) report OS inventory data. A patch compliance API periodically reads this data, and cross references metadata to determine if the latest updates are installed.  This is not the only Patch Management solution available to your organization and you should weigh your needs before committing to using this method.",
@@ -1168,7 +1168,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Storage",
+          "Section": "5 Storage",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that IAM policy on Cloud Storage bucket does not allows anonymous or public access.",
@@ -1189,7 +1189,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Storage",
+          "Section": "5 Storage",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that uniform bucket-level access is enabled on Cloud Storage buckets.",
@@ -1210,7 +1210,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
+          "Section": "6 Cloud SQL Database Services",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to have all SQL database instances set to enable automated backups.",
@@ -1231,7 +1231,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
+          "Section": "6 Cloud SQL Database Services",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to configure Second Generation Sql instance to use private IPs instead of public IPs.",
@@ -1252,7 +1252,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
+          "Section": "6 Cloud SQL Database Services",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Database Server should accept connections only from trusted Network(s)/IP(s) and restrict access from public IP addresses.",
@@ -1273,7 +1273,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
+          "Section": "6 Cloud SQL Database Services",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to enforce all incoming connections to SQL database instance to use SSL.",
@@ -1292,8 +1292,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.1. MySQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.1 MySQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "It is recommended to set a password for the administrative user (`root` by default) to prevent unauthorized access to the SQL database instances.  This recommendation is applicable only for MySQL Instances. PostgreSQL does not offer any setting for No Password from the cloud console.",
@@ -1314,8 +1314,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.1. MySQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.1 MySQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to set `skip_show_database` database flag for Cloud SQL Mysql instance to `on`",
@@ -1336,8 +1336,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.1. MySQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.1 MySQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to set the `local_infile` database flag for a Cloud SQL MySQL instance to `off`.",
@@ -1358,8 +1358,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.2 PostgreSQL Database",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "The `log_error_verbosity` flag controls the verbosity/details of messages logged. Valid values are: - `TERSE` - `DEFAULT` - `VERBOSE`  `TERSE` excludes the logging of `DETAIL`, `HINT`, `QUERY`, and `CONTEXT` error information.  `VERBOSE` output includes the `SQLSTATE` error code, source code file name, function name, and line number that generated the error.  Ensure an appropriate value is set to 'DEFAULT' or stricter.",
@@ -1380,8 +1380,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.2 PostgreSQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The `log_min_error_statement` flag defines the minimum message severity level that are considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `LOG`, `FATAL`, and `PANIC`. Each severity level includes the subsequent levels mentioned above. Ensure a value of `ERROR` or stricter is set.",
@@ -1402,8 +1402,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.2 PostgreSQL Database",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "The value of `log_statement` flag determined the SQL statements that are logged. Valid values are: - `none` - `ddl` - `mod` - `all`  The value `ddl` logs all data definition statements. The value `mod` logs all ddl statements, plus data-modifying statements.  The statements are logged after a basic parsing is done and statement type is determined, thus this does not logs statements with errors. When using extended query protocol, logging occurs after an Execute message is received and values of the Bind parameters are included.  A value of 'ddl' is recommended unless otherwise directed by your organization's logging policy.",
@@ -1424,8 +1424,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.2 PostgreSQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Instance addresses can be public IP or private IP. Public IP means that the instance is accessible through the public internet. In contrast, instances using only private IP are not accessible through the public internet, but are accessible through a Virtual Private Cloud (VPC).  Limiting network access to your database will limit potential attacks.",
@@ -1446,8 +1446,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.2 PostgreSQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Ensure `cloudsql.enable_pgaudit` database flag for Cloud SQL PostgreSQL instance is set to `on` to allow for centralized logging.",
@@ -1468,8 +1468,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.2 PostgreSQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enabling the `log_connections` setting causes each attempted connection to the server to be logged, along with successful completion of client authentication. This parameter cannot be changed after the session starts.",
@@ -1490,8 +1490,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.2 PostgreSQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enabling the `log_disconnections` setting logs the end of each session, including the session duration.",
@@ -1512,8 +1512,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.2 PostgreSQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The `log_min_duration_statement` flag defines the minimum amount of execution time of a statement in milliseconds where the total duration of the statement is logged. Ensure that `log_min_duration_statement` is disabled, i.e., a value of `-1` is set.",
@@ -1534,8 +1534,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.2 PostgreSQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The `log_min_messages` flag defines the minimum message severity level that is considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `LOG`, `FATAL`, and `PANIC`. Each severity level includes the subsequent levels mentioned above. ERROR is considered the best practice setting. Changes should only be made in accordance with the organization's logging policy.",
@@ -1556,8 +1556,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.3 SQL Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to set `3625 (trace flag)` database flag for Cloud SQL SQL Server instance to `on`.",
@@ -1578,8 +1578,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.3 SQL Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to set `external scripts enabled` database flag for Cloud SQL SQL Server instance to `off`",
@@ -1600,8 +1600,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.3 SQL Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to set `remote access` database flag for Cloud SQL SQL Server instance to `off`.",
@@ -1622,8 +1622,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.3 SQL Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to check the `user connections` for a Cloud SQL SQL Server instance to ensure that it is not artificially limiting connections.",
@@ -1644,8 +1644,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.3 SQL Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that, `user options` database flag for Cloud SQL SQL Server instance should not be configured.",
@@ -1666,8 +1666,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.3 SQL Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to set `contained database authentication` database flag for Cloud SQL on the SQL Server instance to `off`.",
@@ -1688,8 +1688,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.3 SQL Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to set `cross db ownership chaining` database flag for Cloud SQL SQL Server instance to `off`.",
@@ -1710,7 +1710,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. BigQuery",
+          "Section": "7 BigQuery",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys. The data is encrypted using the `data encryption keys` and data encryption keys themselves are further encrypted using `key encryption keys`. This is seamless and do not require any additional input from the user. However, if you want to have greater control, Customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery Data Sets.",
@@ -1731,7 +1731,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. BigQuery",
+          "Section": "7 BigQuery",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys. The data is encrypted using the `data encryption keys` and data encryption keys themselves are further encrypted using `key encryption keys`. This is seamless and do not require any additional input from the user. However, if you want to have greater control, Customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery Data Sets. If CMEK is used, the CMEK is used to encrypt the data encryption keys instead of using google-managed encryption keys.",
@@ -1752,7 +1752,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. BigQuery",
+          "Section": "7 BigQuery",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that the IAM policy on BigQuery datasets does not allow anonymous and/or public access.",
diff --git a/prowler/compliance/gcp/cis_3.0_gcp.json b/prowler/compliance/gcp/cis_3.0_gcp.json
index a0e860e81d..8ebe8cd6df 100644
--- a/prowler/compliance/gcp/cis_3.0_gcp.json
+++ b/prowler/compliance/gcp/cis_3.0_gcp.json
@@ -10,7 +10,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Use corporate login credentials instead of consumer accounts, such as Gmail accounts.",
@@ -30,7 +30,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Setup multi-factor authentication for Google Cloud Platform accounts.",
@@ -50,7 +50,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Setup Security Key Enforcement for Google Cloud Platform admin accounts.",
@@ -72,7 +72,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "User-managed service accounts should not have user-managed keys.",
@@ -94,7 +94,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "A service account is a special Google account that belongs to an application or a VM, instead of to an individual end-user. The application uses the service account to call the service's Google API so that users aren't directly involved. It's recommended not to use admin access for ServiceAccount.",
@@ -116,7 +116,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to assign the `Service Account User (iam.serviceAccountUser)` and `Service Account Token Creator (iam.serviceAccountTokenCreator)` roles to a user for a specific service account rather than assigning the role to a user at project level.",
@@ -138,7 +138,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Service Account keys consist of a key ID (Private_key_Id) and Private key, which are used to sign programmatic requests users make to Google cloud services accessible to that particular service account. It is recommended that all Service Account keys are regularly rotated.",
@@ -160,7 +160,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that the principle of 'Separation of Duties' is enforced while assigning service-account related roles to users.",
@@ -182,7 +182,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that the IAM policy on Cloud KMS `cryptokeys` should restrict anonymous and/or public access.",
@@ -204,7 +204,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Google Cloud Key Management Service stores cryptographic keys in a hierarchical structure designed for useful and elegant access control management. The format for the rotation schedule depends on the client library that is used. For the gcloud command-line tool, the next rotation time must be in `ISO` or `RFC3339` format, and the rotation period must be in the form `INTEGER[UNIT]`, where units can be one of seconds (s), minutes (m), hours (h) or days (d).",
@@ -226,7 +226,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that the principle of 'Separation of Duties' is enforced while assigning KMS related roles to users.",
@@ -248,7 +248,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. Unused keys with their permissions in tact may still exist within a project. Keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to use standard authentication flow instead.",
@@ -268,7 +268,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. In this case, unrestricted keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API key usage to trusted hosts, HTTP referrers and apps. It is recommended to use the more secure standard authentication flow instead.",
@@ -290,7 +290,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. API keys are always at risk because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API keys to use (call) only APIs required by an application.",
@@ -312,7 +312,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. If they are in use it is recommended to rotate API keys every 90 days.",
@@ -334,7 +334,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that Essential Contacts is configured to designate email addresses for Google Cloud services to notify of important technical or security information.",
@@ -354,7 +354,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Identity and Access Management",
+          "Section": "1 Identity and Access Management",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Google Cloud Functions allow you to host serverless code that is executed when an event is triggered, without the requiring the management a host operating system. These functions can also store environment variables to be used by the code that may contain authentication or other information that needs to remain confidential.",
@@ -376,7 +376,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that Cloud Audit Logging is configured to track all admin activities and read, write access to user data.",
@@ -398,7 +398,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to create a sink that will export copies of all the log entries. This can help aggregate logs from multiple projects and export them to a Security Information and Event Management (SIEM).",
@@ -420,7 +420,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Enabling retention policies on log buckets will protect logs stored in cloud storage buckets from being overwritten or accidentally deleted. It is recommended to set up retention policies and configure Bucket Lock on all storage buckets that are used as log sinks.",
@@ -442,7 +442,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "In order to prevent unnecessary project ownership assignments to users/service-accounts and further misuses of projects and resources, all `roles/Owner` assignments should be monitored.Members (users/Service-Accounts) with a role assignment to primitive role `roles/Owner` are project owners.The project owner has all the privileges on the project the role belongs to. These are summarized below:- All viewer permissions on all GCP Services within the project- Permissions for actions that modify the state of all GCP services within the project- Manage roles and permissions for a project and all resources within the project- Set up billing for a projectGranting the owner role to a member (user/Service-Account) will allow that member to modify the Identity and Access Management (IAM) policy. Therefore, grant the owner role only if the member has a legitimate purpose to manage the IAM policy. This is because the project IAM policy contains sensitive access control data. Having a minimal set of users allowed to manage IAM policy will simplify any auditing that may be necessary.",
@@ -464,7 +464,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Google Cloud Platform (GCP) services write audit log entries to the Admin Activity and Data Access logs to help answer the questions of, \"who did what, where, and when?\" within GCP projects.Cloud audit logging records information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by GCP services. Cloud audit logging provides a history of GCP API calls for an account, including API calls made via the console, SDKs, command-line tools, and other GCP services.",
@@ -486,7 +486,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that a metric filter and alarm be established for changes to Identity and Access Management (IAM) role creation, deletion and updating activities.",
@@ -508,7 +508,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) Network Firewall rule changes.",
@@ -530,7 +530,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) network route changes.",
@@ -552,7 +552,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) network changes.",
@@ -574,7 +574,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that a metric filter and alarm be established for Cloud Storage Bucket IAM changes.",
@@ -596,7 +596,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that a metric filter and alarm be established for SQL instance configuration changes.",
@@ -616,7 +616,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Cloud DNS logging records the queries from the name servers within your VPC to Stackdriver. Logged queries can come from Compute Engine VMs, GKE containers, or other GCP resources provisioned within the VPC.",
@@ -638,7 +638,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "GCP Cloud Asset Inventory is services that provides a historical view of GCP resources and IAM policies through a time-series database. The information recorded includes metadata on Google Cloud resources, metadata on policies set on Google Cloud projects or resources, and runtime information gathered within a Google Cloud resource.Cloud Asset Inventory Service (CAIS) API enablement is not required for operation of the service, but rather enables the mechanism for searching/exporting CAIS asset data directly.",
@@ -658,7 +658,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "GCP Access Transparency provides audit logs for all actions that Google personnel take in your Google Cloud resources.",
@@ -680,7 +680,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "GCP Access Approval enables you to require your organizations' explicit approval whenever Google support try to access your projects. You can then select users within your organization who can approve these requests through giving them a security role in IAM. All access requests display which Google Employee requested them in an email or Pub/Sub message that you can choose to Approve. This adds an additional control and logging of who in your organization approved/denied these requests.",
@@ -702,7 +702,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. Logging and Monitoring",
+          "Section": "2 Logging and Monitoring",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Logging enabled on a HTTPS Load Balancer will show all network traffic and its destination.",
@@ -724,7 +724,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Networking",
+          "Section": "3 Networking",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "To prevent use of `default` network, a project should not have a `default` network.",
@@ -746,7 +746,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Networking",
+          "Section": "3 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "In order to prevent use of legacy networks, a project should not have a legacy network configured. As of now, Legacy Networks are gradually being phased out, and you can no longer create projects with them. This recommendation is to check older projects to ensure that they are not using Legacy Networks.",
@@ -768,7 +768,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Networking",
+          "Section": "3 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Cloud Domain Name System (DNS) is a fast, reliable and cost-effective domain name system that powers millions of domains on the internet. Domain Name System Security Extensions (DNSSEC) in Cloud DNS enables domain owners to take easy steps to protect their domains against DNS hijacking and man-in-the-middle and other attacks.",
@@ -790,7 +790,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Networking",
+          "Section": "3 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract.DNSSEC algorithm numbers in this registry may be used in CERT RRs. Zone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. The algorithm used for key signing should be a recommended one and it should be strong.",
@@ -812,7 +812,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Networking",
+          "Section": "3 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract.DNSSEC algorithm numbers in this registry may be used in CERT RRs. Zone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. The algorithm used for key signing should be a recommended one and it should be strong.",
@@ -834,7 +834,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Networking",
+          "Section": "3 Networking",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "GCP `Firewall Rules` are specific to a `VPC Network`. Each rule either `allows` or `denies` traffic when its conditions are met. Its conditions allow the user to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances.Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, only an `IPv4` address or `IPv4 block in CIDR` notation can be used. Generic `(0.0.0.0/0)` incoming traffic from the internet to VPC or VM instance using `SSH` on `Port 22` can be avoided.",
@@ -856,7 +856,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Networking",
+          "Section": "3 Networking",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "GCP `Firewall Rules` are specific to a `VPC Network`. Each rule either `allows` or `denies` traffic when its conditions are met. Its conditions allow users to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances.Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, an `IPv4` address or `IPv4 block in CIDR` notation can be used. Generic `(0.0.0.0/0)` incoming traffic from the Internet to a VPC or VM instance using `RDP` on `Port 3389` can be avoided.",
@@ -878,7 +878,7 @@
       ],
       "Attributes": [
         {
-          "Section": "3. Networking",
+          "Section": "3 Networking",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Flow Logs is a feature that enables users to capture information about the IP traffic going to and from network interfaces in the organization's VPC Subnets. Once a flow log is created, the user can view and retrieve its data in Stackdriver Logging. It is recommended that Flow Logs be enabled for every business-critical VPC subnet.",
@@ -898,7 +898,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Networking",
+          "Section": "3 Networking",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Secure Sockets Layer (SSL) policies determine what port Transport Layer Security (TLS) features clients are permitted to use when connecting to load balancers. To prevent usage of insecure features, SSL policies should use (a) at least TLS 1.2 with the MODERN profile; or (b) the RESTRICTED profile, because it effectively requires clients to use TLS 1.2 regardless of the chosen minimum TLS version; or (3) a CUSTOM profile that does not support any of the following features: ```TLS_RSA_WITH_AES_128_GCM_SHA256TLS_RSA_WITH_AES_256_GCM_SHA384TLS_RSA_WITH_AES_128_CBC_SHATLS_RSA_WITH_AES_256_CBC_SHATLS_RSA_WITH_3DES_EDE_CBC_SHA```",
@@ -918,7 +918,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Networking",
+          "Section": "3 Networking",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "IAP authenticates the user requests to your apps via a Google single sign in. You can then manage these users with permissions to control access. It is recommended to use both IAP permissions and firewalls to restrict this access to your apps with sensitive information.",
@@ -940,7 +940,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to configure your instance to not use the default Compute Engine service account because it has the Editor role on the project.",
@@ -962,7 +962,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "To support principle of least privileges and prevent potential privilege escalation it is recommended that instances are not assigned to default service account `Compute Engine default service account` with Scope `Allow full access to all Cloud APIs`.",
@@ -984,7 +984,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to use Instance specific SSH key(s) instead of using common/shared project-wide SSH key(s) to access Instances.",
@@ -1006,7 +1006,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enabling OS login binds SSH certificates to IAM users and facilitates effective SSH certificate management.",
@@ -1028,7 +1028,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Interacting with a serial port is often referred to as the serial console, which is similar to using a terminal window, in that input and output is entirely in text mode and there is no graphical interface or mouse support.If you enable the interactive serial console on an instance, clients can attempt to connect to that instance from any IP address. Therefore interactive serial console support should be disabled.",
@@ -1050,7 +1050,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets.Forwarding of data packets should be disabled to prevent data loss or information disclosure.",
@@ -1072,7 +1072,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Customer-Supplied Encryption Keys (CSEK) are a feature in Google Cloud Storage and Google Compute Engine. If you supply your own encryption keys, Google uses your key to protect the Google-generated keys used to encrypt and decrypt your data. By default, Google Compute Engine encrypts all data at rest. Compute Engine handles and manages this encryption for you without any additional actions on your part. However, if you wanted to control and manage this encryption yourself, you can provide your own encryption keys.",
@@ -1094,7 +1094,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "To defend against advanced threats and ensure that the boot loader and firmware on your VMs are signed and untampered, it is recommended that Compute instances are launched with Shielded VM enabled.",
@@ -1116,7 +1116,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Compute instances should not be configured to have external IP addresses.",
@@ -1136,7 +1136,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "In order to maintain the highest level of security all connections to an application should be secure by default.",
@@ -1158,7 +1158,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Google Cloud encrypts data at-rest and in-transit, but customer data must be decrypted for processing. Confidential Computing is a breakthrough technology which encrypts data in-use—while it is being processed. Confidential Computing environments keep data encrypted in memory and elsewhere outside the central processing unit (CPU). Confidential VMs leverage the Secure Encrypted Virtualization (SEV) feature of AMD EPYC™ CPUs. Customer data will stay encrypted while it is used, indexed, queried, or trained on. Encryption keys are generated in hardware, per VM, and not exportable. Thanks to built-in hardware optimizations of both performance and security, there is no significant performance penalty to Confidential Computing workloads.",
@@ -1178,7 +1178,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Virtual Machines",
+          "Section": "4 Virtual Machines",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Google Cloud Virtual Machines have the ability via an OS Config agent API to periodically (about every 10 minutes) report OS inventory data. A patch compliance API periodically reads this data, and cross references metadata to determine if the latest updates are installed.This is not the only Patch Management solution available to your organization and you should weigh your needs before committing to using this method.",
@@ -1200,7 +1200,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Storage",
+          "Section": "5 Storage",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that IAM policy on Cloud Storage bucket does not allows anonymous or public access.",
@@ -1222,7 +1222,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Storage",
+          "Section": "5 Storage",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that uniform bucket-level access is enabled on Cloud Storage buckets.",
@@ -1244,7 +1244,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
+          "Section": "6 Cloud SQL Database Services",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to enforce all incoming connections to SQL database instance to use SSL.",
@@ -1266,7 +1266,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
+          "Section": "6 Cloud SQL Database Services",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Database Server should accept connections only from trusted Network(s)/IP(s) and restrict access from public IP addresses.",
@@ -1288,7 +1288,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
+          "Section": "6 Cloud SQL Database Services",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to configure Second Generation Sql instance to use private IPs instead of public IPs.",
@@ -1310,7 +1310,7 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
+          "Section": "6 Cloud SQL Database Services",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to have all SQL database instances set to enable automated backups.",
@@ -1330,8 +1330,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.1. MySQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.1 MySQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Manual",
           "Description": "It is recommended to set a password for the administrative user (`root` by default) to prevent unauthorized access to the SQL database instances.This recommendation is applicable only for MySQL Instances. PostgreSQL does not offer any setting for No Password from the cloud console.",
@@ -1353,8 +1353,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.1. MySQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.1 MySQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to set `skip_show_database` database flag for Cloud SQL Mysql instance to `on`",
@@ -1376,8 +1376,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.1. MySQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.1 MySQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to set the `local_infile` database flag for a Cloud SQL MySQL instance to `off`.",
@@ -1399,8 +1399,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.2 PostgreSQL Database",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "The `log_error_verbosity` flag controls the verbosity/details of messages logged. Valid values are:- `TERSE`- `DEFAULT`- `VERBOSE``TERSE` excludes the logging of `DETAIL`, `HINT`, `QUERY`, and `CONTEXT` error information.`VERBOSE` output includes the `SQLSTATE` error code, source code file name, function name, and line number that generated the error.Ensure an appropriate value is set to 'DEFAULT' or stricter.",
@@ -1422,8 +1422,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.2 PostgreSQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enabling the `log_connections` setting causes each attempted connection to the server to be logged, along with successful completion of client authentication. This parameter cannot be changed after the session starts.",
@@ -1445,8 +1445,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.2 PostgreSQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Enabling the `log_disconnections` setting logs the end of each session, including the session duration.",
@@ -1468,8 +1468,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.2 PostgreSQL Database",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "The value of `log_statement` flag determined the SQL statements that are logged. Valid values are:- `none`- `ddl`- `mod`- `all`The value `ddl` logs all data definition statements.The value `mod` logs all ddl statements, plus data-modifying statements.The statements are logged after a basic parsing is done and statement type is determined, thus this does not logs statements with errors. When using extended query protocol, logging occurs after an Execute message is received and values of the Bind parameters are included.A value of 'ddl' is recommended unless otherwise directed by your organization's logging policy.",
@@ -1491,8 +1491,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.2 PostgreSQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The `log_min_messages` flag defines the minimum message severity level that is considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include (from lowest to highest severity) `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `LOG`, `FATAL`, and `PANIC`.Each severity level includes the subsequent levels mentioned above. ERROR is considered the best practice setting. Changes should only be made in accordance with the organization's logging policy.",
@@ -1514,8 +1514,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.2 PostgreSQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The `log_min_error_statement` flag defines the minimum message severity level that are considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include (from lowest to highest severity) `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `LOG`, `FATAL`, and `PANIC`.Each severity level includes the subsequent levels mentioned above. Ensure a value of `ERROR` or stricter is set.",
@@ -1537,8 +1537,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.2 PostgreSQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The `log_min_duration_statement` flag defines the minimum amount of execution time of a statement in milliseconds where the total duration of the statement is logged. Ensure that `log_min_duration_statement` is disabled, i.e., a value of `-1` is set.",
@@ -1560,8 +1560,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.2 PostgreSQL Database",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Ensure `cloudsql.enable_pgaudit` database flag for Cloud SQL PostgreSQL instance is set to `on` to allow for centralized logging.",
@@ -1583,8 +1583,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.3 SQL Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to set `external scripts enabled` database flag for Cloud SQL SQL Server instance to `off`",
@@ -1606,8 +1606,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.3 SQL Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to set `cross db ownership chaining` database flag for Cloud SQL SQL Server instance to `off`.This flag is deprecated for all SQL Server versions in CGP. Going forward, you can't set its value to on. However, if you have this flag enabled, we strongly recommend that you either remove the flag from your database or set it to off. For cross-database access, use the [Microsoft tutorial for signing stored procedures with a certificate](https://learn.microsoft.com/en-us/sql/relational-databases/tutorial-signing-stored-procedures-with-a-certificate?view=sql-server-ver16).",
@@ -1629,8 +1629,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.3 SQL Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to check the `user connections` for a Cloud SQL SQL Server instance to ensure that it is not artificially limiting connections.",
@@ -1652,8 +1652,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.3 SQL Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that, `user options` database flag for Cloud SQL SQL Server instance should not be configured.",
@@ -1675,8 +1675,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.3 SQL Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to set `remote access` database flag for Cloud SQL SQL Server instance to `off`.",
@@ -1694,12 +1694,12 @@
       "Id": "6.3.6",
       "Description": "Ensure '3625 (trace flag)' database flag for all Cloud SQL Server instances is set to 'on'",
       "Checks": [
-        "cloudsql_instance_sqlserver_trace_flag\""
+        "cloudsql_instance_sqlserver_trace_flag"
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.3 SQL Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended to set `3625 (trace flag)` database flag for Cloud SQL SQL Server instance to `on`.",
@@ -1721,8 +1721,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6 Cloud SQL Database Services",
+          "SubSection": "6.3 SQL Server",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended not to set `contained database authentication` database flag for Cloud SQL on the SQL Server instance to `on`.",
@@ -1744,7 +1744,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. BigQuery",
+          "Section": "7 BigQuery",
           "Profile": "Level 1",
           "AssessmentStatus": "Automated",
           "Description": "It is recommended that the IAM policy on BigQuery datasets does not allow anonymous and/or public access.",
@@ -1766,7 +1766,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. BigQuery",
+          "Section": "7 BigQuery",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys. The data is encrypted using the `data encryption keys` and data encryption keys themselves are further encrypted using `key encryption keys`. This is seamless and do not require any additional input from the user. However, if you want to have greater control, Customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery Data Sets. If CMEK is used, the CMEK is used to encrypt the data encryption keys instead of using google-managed encryption keys.",
@@ -1788,7 +1788,7 @@
       ],
       "Attributes": [
         {
-          "Section": "7. BigQuery",
+          "Section": "7 BigQuery",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys. The data is encrypted using the `data encryption keys` and data encryption keys themselves are further encrypted using `key encryption keys`. This is seamless and do not require any additional input from the user. However, if you want to have greater control, Customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery Data Sets.",
@@ -1808,7 +1808,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "7. BigQuery",
+          "Section": "7 BigQuery",
           "Profile": "Level 2",
           "AssessmentStatus": "Manual",
           "Description": "BigQuery tables can contain sensitive data that for security purposes should be discovered, monitored, classified, and protected. Google Cloud's Sensitive Data Protection tools can automatically provide data classification of all BigQuery data across an organization.",
@@ -1830,7 +1830,7 @@
       ],
       "Attributes": [
         {
-          "Section": "8. Dataproc",
+          "Section": "8 Dataproc",
           "Profile": "Level 2",
           "AssessmentStatus": "Automated",
           "Description": "When you use Dataproc, cluster and job data is stored on Persistent Disks (PDs) associated with the Compute Engine VMs in your cluster and in a Cloud Storage staging bucket. This PD and bucket data is encrypted using a Google-generated data encryption key (DEK) and key encryption key (KEK). The CMEK feature allows you to create, use, and revoke the key encryption key (KEK). Google still controls the data encryption key (DEK).",
diff --git a/prowler/compliance/github/cis_1.0_github.json b/prowler/compliance/github/cis_1.0_github.json
index f5431f2d44..3f0037c9e0 100644
--- a/prowler/compliance/github/cis_1.0_github.json
+++ b/prowler/compliance/github/cis_1.0_github.json
@@ -1,7 +1,2591 @@
 {
   "Framework": "CIS",
   "Version": "1.0",
-  "Provider": "Github",
-  "Description": "This CIS Benchmark provides prescriptive guidance for establishing a secure configuration posture for securing the Software Supply Chain.",
-  "Requirements": []
+  "Provider": "GitHub",
+  "Description": "This document provides prescriptive guidance for establishing a secure configuration posture for securing GitHub.",
+  "Requirements": [
+    {
+      "Id": "Id",
+      "Description": "Title",
+      "Checks": [
+        "Checks"
+      ],
+      "Attributes": [
+        {
+          "Section": "Attributes_Section",
+          "Profile": "Attributes_Level",
+          "AssessmentStatus": "Attributes_AssessmentStatus",
+          "Description": "Attributes_Description",
+          "RationaleStatement": "Attributes_RationaleStatement",
+          "ImpactStatement": "Attributes_ImpactStatement",
+          "RemediationProcedure": "Attributes_RemediationProcedure",
+          "AuditProcedure": "Attributes_AuditProcedure",
+          "AdditionalInformation": "Attributes_AdditionalInformation",
+          "References": "Attributes_References"
+        }
+      ]
+    },
+    {
+      "Id": "1.1.1",
+      "Description": "Ensure any changes to code are tracked in a version control platform",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Manage all code projects in a version control platform.",
+          "RationaleStatement": "Version control platforms keep track of every modification to code. They represent the cornerstone of code security, as well as allowing for better code collaboration within engineering teams. With granular access management, change tracking, and key signing of code edits, version control platforms are the first step in securing the software supply chain.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Upload existing code projects to a dedicated Github organization and repositories and create an identity for each active team member who might contribute or need access to it.",
+          "AuditProcedure": "Ensure that all code activity is managed through Github repository for every micro-service or application developed by an organization.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.1.2",
+      "Description": "Ensure any change to code can be traced back to its associated task",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Use a task management system to trace any code back to its associated task.",
+          "RationaleStatement": "The ability to trace each piece of code back to its associated task simplifies the Agile and DevOps process by enabling transparency of any code changes. This allows faster remediation of bugs and security issues, while also making it harder to push unauthorized code changes to sensitive projects. Additionally, using a task management system simplifies achieving compliance, as it is easier to track each regulation.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Use a task management system to manage tasks as the starting point for each code change. Whether it is a new feature, bug fix, or security fix - all should originate from a dedicated task (ticket) in your organization's task management system. These tasks should also be linked to the code changes themselves in a way that is easy to follow: from code to task, and from task back to code.",
+          "AuditProcedure": "Ensure every code change can be traced back to its origin task in a task management system.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.1.3",
+      "Description": "Ensure any change to code receives approval of two strongly authenticated users",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Automated",
+          "Description": "Ensure that every code change is reviewed and approved by two authorized contributors who are both strongly authenticated - using Multi-Factor Authentication (MFA), from the team relevant to the code change.",
+          "RationaleStatement": "To prevent malicious or unauthorized code changes, the first layer of protection is the process of code review. This process involves engineer teammates reviewing each other's code for errors, optimizations, and general knowledge-sharing. With proper peer reviews in place, an organization can detect unwanted code changes very early in the process of release. In order to help facilitate code review, companies should employ automation to verify that every code change has been reviewed and approved by at least two team members before it is pushed into the code base. These team members should be from the team that is related to the code change, so it will be a meaningful review.",
+          "ImpactStatement": "To enforce a code review requirement, verification for a minimum of two reviewers must be put into place. This will ensure new code will not be able to be pushed to the code base before it has received two independent approvals.",
+          "RemediationProcedure": "For every code repository in use, perform the next steps to require two approvals from the specific code repository team in order to push new code to the code base:\n \n\n 1. On GitHub, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n 5. If you added the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n 6. Check **Require a pull request before merging** and **Require approvals**, and set **Required number of approvals before merging** to 2.\n 5. Click **Create** or **Save changes**.",
+          "AuditProcedure": "For every code repository in use, perform the next steps to verify that two approvals from the specific code repository team are required to push new code to the code base:\n \n\n 1. On GitHub, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n 5. Ensure that **Require a pull request before merging** and **Require approvals** are checked, and verify that **Required number of approvals before merging** is set to 2.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.1.4",
+      "Description": "Ensure previous approvals are dismissed when updates are introduced to a code change proposal",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure that when a proposed code change is updated, previous approvals are declined, and new approvals are required.",
+          "RationaleStatement": "An approval process is necessary when code changes are suggested. Through this approval process, however, changes can still be made to the original proposal even after some approvals have already been given. This means malicious code can find its way into the code base even if the organization has enforced a review policy. To ensure this is not possible, outdated approvals must be declined when changes to the suggestion are introduced.",
+          "ImpactStatement": "If new code changes are pushed to a specific proposal, all previously accepted code change proposals must be declined.",
+          "RemediationProcedure": "For each code repository in use, perform the next steps to enforce dismissal of given approvals to code change suggestions if those suggestions were updated:\n \n\n 1. On GitHub, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n 5. If you added the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n 6. Select **Require pull request reviews before merging** and then **Dismiss stale pull request approvals when new commits are pushed**.\n 5. Click **Create** or **Save changes**.",
+          "AuditProcedure": "For each code repository in use, perform the next steps to verify that each updated code suggestion declines the previously received approvals:\n \n\n 1. On GitHub, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n 5. Ensure that **Require a pull request before merging** is checked, and verify that **Dismiss stale pull request approvals when new commits are pushed** is checked.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.1.5",
+      "Description": "Ensure there are restrictions on who can dismiss code change reviews",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Only trusted users should be allowed to dismiss code change reviews.",
+          "RationaleStatement": "Dismissing a code change review permits users to merge new suggested code changes without going through the standard process of approvals. Controlling who can perform this action will prevent malicious actors from simply dismissing the required reviews to code changes and merging malicious or dysfunctional code into the code base.",
+          "ImpactStatement": "In cases where a code change proposal has been updated since it was last reviewed and the person who reviewed it isn't available for approval, a general collaborator would not be able to merge their code changes until a user with \"dismiss review\" abilities could dismiss the open review.\n \n\n Users who are not allowed to dismiss code change reviews will not be permitted to do so, and thus are unable to waive the standard flow of approvals.",
+          "RemediationProcedure": "For each code repository in use, perform the next steps to restrict dismissal of code changes reviews unless it is necessary:\n \n\n 1. On GitHub, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n 5. If you added the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n 4. Select **Require pull request reviews before merging** and **Restrict who can dismiss pull request reviews**.\n 5. Do not add any user or team unless it is obligatory. If it is obligatory, carefully select the users or teams whom you trust with the ability to dismiss code change reviews.\n 6. Click **Create** or **Save changes**.",
+          "AuditProcedure": "For each code repository in use, perform the next steps to verify that only trusted users are allowed to dismiss code change reviews: \n \n\n 1. On GitHub, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n 4. Verify that **Require a pull request before merging** and **Restrict who can dismiss pull request reviews** is checked.\n 5. Verify that no users and teams are specified except for organization and repository admins. If it is obligatory, verify that the users or teams specified were carefully selected to be trusted with the ability to dismiss code change reviews.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.1.6",
+      "Description": "Ensure code owners are set for extra sensitive code or configuration",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Code owners are trusted users that are responsible for reviewing and managing an important piece of code or configuration. An organization is advised to set code owners for every extremely sensitive code or configuration.",
+          "RationaleStatement": "Configuring code owners protects data by verifying that trusted users will notice and review every edit, thus preventing unwanted or malicious changes from potentially compromising sensitive code or configurations.",
+          "ImpactStatement": "Code owner users will receive notifications for every change that occurs to the code and subsequently added as reviewers of pull requests automatically.",
+          "RemediationProcedure": "In every code repository create a CODEOWNERS file in the root, docs/, or .github/ directory of the repository.\n In the file, specify codeowners for the .github/workflows/ directory atleast. Specify organization members you trust. For example:\n ```\n .github/workflows/ @user1 @user2\n ```",
+          "AuditProcedure": "In every code repository, verify that a file named CODEOWNERS exists in the root, docs/, or .github/ directory of the repository.\n In the CODEOWNERS file, verify that the users specified are users you trust.",
+          "AdditionalInformation": "",
+          "References": "https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners"
+        }
+      ]
+    },
+    {
+      "Id": "1.1.7",
+      "Description": "Ensure code owner's review is required when a change affects owned code",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure trusted code owners are required to review and approve any code change proposal made to their respective owned areas in the code base.",
+          "RationaleStatement": "Configuring code owners ensures that no code, especially code which could prove malicious, will slip into the source code or configuration files of a repository. This allows an organization to mark areas in the code base that are especially sensitive or more prone to an attack. It can also enforce review by specific individuals who are designated as owners to those areas so that they may filter out unauthorized or unwanted changes beforehand.",
+          "ImpactStatement": "If an organization enforces code owner-based reviews, some code change proposals would not be able to be merged to the codebase before specific, trusted individuals approve them.",
+          "RemediationProcedure": "For every code repository in use, perform the following steps to require code owners' approvals for each change proposal related to code they own:\n \n\n 1. On GitHub, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n 5. If you add the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n 6. Select **Require pull request reviews before merging** and **Require review from Code Owners**.\n 7. Click **Create** or **Save changes**.",
+          "AuditProcedure": "For every code repository in use, perform the following steps to verify that code owners are required to review all code change proposals relevant to areas they own before code merge:\n \n\n 1. On GitHub, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n 4. Ensure that **Require a pull request before merging** and **Require review from Code Owners** are checked.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.1.8",
+      "Description": "Ensure inactive branches are periodically reviewed and removed",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Keep track of code branches that are inactive for a lengthy period of time and periodically remove them.",
+          "RationaleStatement": "Git branches that have been inactive (i.e., no new changes introduced) for a long period of time are enlarging the surface of attack for malicious code injection, sensitive data leaks, and CI pipeline exploitation. They potentially contain outdated dependencies which may leave them highly vulnerable. They are more likely to be improperly managed, and could possibly be accessed by a large number of members of the organization.",
+          "ImpactStatement": "Removing inactive Git branches means that any code changes they contain would be removed along with them, thus work done in the past might not be accessible after auditing for inactivity.",
+          "RemediationProcedure": "For each code repository in use, review existing Git branches and remove those which have not been active for a period of time by performing the following:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Above the list of files, click **Branches**.\n 3. Use the navigation at the top of the page to view the Stale branches. The Stale view shows all branches that no one has committed to in the last three months, ordered by the branches with the oldest commits first.\n 4. For each branch listed, either delete it by clicking the trash bin icon, or find the valid reason it still exists.\n \n\n You can perform the next steps to prevent pull request branches from becoming stale branches:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click Settings.\n 3. Under \"Pull Requests\", select **Automatically delete head branches**.",
+          "AuditProcedure": "For each code repository in use, verify that all existing Git branches are active or have yet to be checked for inactivity by performing the next steps:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Above the list of files, click **Branches**.\n 3. Use the navigation at the top of the page to view the Stale branches. The Stale view shows all branches that no one has committed to in the last three months, ordered by the branches with the oldest commits first.\n 4. If the list is empty, you are compliant. If the list is not empty, but there is a valid reason the branches listed are not deleted, you are compliant.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.1.9",
+      "Description": "Ensure all checks have passed before merging new code",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Before a code change request can be merged to the code base, all predefined checks must successfully pass.",
+          "RationaleStatement": "On top of manual reviews of code changes, a code protect should contain a set of prescriptive checks which validate each change. Organizations should enforce those status checks so that changes can only be introduced if all checks have successfully passed. This set of checks should serve as the absolute quality, stability, and security conditions which must be met in order to merge new code to a project.",
+          "ImpactStatement": "Code changes in which all checks do not pass successfully would not be able to be pushed into the code base of the specific code repository.",
+          "RemediationProcedure": "For each code repository in use, require all status checks to pass before permitting a merge of new code by performing the following:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", check if there is a rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n 5. If you add the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n 6. Select **Require status checks to pass before merging**.\n 7. Click **Create** or **Save changes**.",
+          "AuditProcedure": "For each code repository in use, verify that status checks are required to pass before allowing any code change proposal merge by performing the following:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n 5. Ensure that **Require status checks to pass before merging** is checked.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.1.10",
+      "Description": "Ensure open Git branches are up to date before they can be merged into code base",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Organizations should make sure each suggested code change is in full sync with the existing state of its origin code repository before allowing merging.",
+          "RationaleStatement": "Git branches can easily become outdated since the origin code repository is constantly being edited. This means engineers working on separate code branches can accidentally include outdated code with potential security issues which might have already been fixed, overriding the potential solutions for those security issues when merging their own changes.",
+          "ImpactStatement": "If enforced, outdated branches would not be able to be merged into their origin repository without first being updated to contain any recent changes.",
+          "RemediationProcedure": "For each code repository in use, enforce a policy to only allow merging open branches if they are current with the latest change from their original repository by performing the following:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n 5. If you add the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n 6. Select **Require status checks to pass before merging** and **Require branches to be up to date before merging**.\n 7. Click **Create** or **Save changes**.",
+          "AuditProcedure": "For each code repository in use, verify that open branches must be updated before merging is permitted by performing the following:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n 5. Ensure that **Require status checks to pass before merging** and **Require branches to be up to date before merging** are checked.",
+          "AdditionalInformation": "",
+          "References": "https://github.blog/changelog/2022-02-03-more-ways-to-keep-your-pull-request-branch-up-to-date/"
+        }
+      ]
+    },
+    {
+      "Id": "1.1.11",
+      "Description": "Ensure all open comments are resolved before allowing code change merging",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.1",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Organizations should enforce a \"no open comments\" policy before allowing code change merging.",
+          "RationaleStatement": "In an open code change proposal, reviewers can leave comments containing their questions and suggestions. These comments can also include potential bugs and security issues. Requiring all comments on a code change proposal to be resolved before it can be merged ensures that every concern is properly addressed or acknowledged before the new code changes are introduced to the code base.",
+          "ImpactStatement": "Code change proposals containing open comments would not be able to be merged into the code base.",
+          "RemediationProcedure": "For each code repository in use, require open comments to be resolved before the relevant code change can be merged by performing the following:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n 5. If you add the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n 6. Select **Require conversation resolution before merging**.\n 7. Click **Create** or **Save changes**.",
+          "AuditProcedure": "For every code repository in use, verify that each merged code change does not contain open, unattended comments by performing the following:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n 5. Ensure that **Require conversation resolution before merging** is checked.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.1.12",
+      "Description": "Ensure verification of signed commits for new changes before merging",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.1",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure every commit in a pull request is signed and verified before merging.",
+          "RationaleStatement": "Signing commits, or requiring to sign commits, gives other users confidence about the origin of a specific code change. It ensures that the author of the change is not hidden and is verified by the version control system, thus the change comes from a trusted source.",
+          "ImpactStatement": "Pull requests with unsigned commits cannot be merged.",
+          "RemediationProcedure": "For each repository in use, enforce the branch protection rule of requiring signed commits, and make sure only signed commits are capable of merging by performing the following:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n 5. If you add the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n 6. Select **Require signed commits**.\n 7. Click **Create** or **Save changes**.",
+          "AuditProcedure": "Ensure only signed commits can be merged for every branch, especially the main branch, via branch protection rules by performing the following:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n 5. Ensure that **Require signed commits** is checked.",
+          "AdditionalInformation": "",
+          "References": "https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits"
+        }
+      ]
+    },
+    {
+      "Id": "1.1.13",
+      "Description": "Ensure linear history is required",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.1",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Linear history is the name for Git history where all commits are listed in chronological order, one after another. Such history exists if a pull request is merged either by rebase merge (re-order the commits history) or squash merge (squashes all commits to one). Ensure that linear history is required by requiring the use of rebase or squash merge when merging a pull request.",
+          "RationaleStatement": "Enforcing linear history produces a clear record of activity, and as such it offers specific advantages: it is easier to follow, easier to revert a change, and bugs can be found more easily.",
+          "ImpactStatement": "Pull request cannot be merged except squash or rebase merge.",
+          "RemediationProcedure": "For every code repository in use, perform the following steps to require linear history and/or allow only rebase merge and squash merge:\n \n\n 1. On GitHub, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n 5. If you add the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n 6. Select **Require linear history**.\n 7. Click **Create** or **Save changes**.",
+          "AuditProcedure": "For every code repository in use, perform the following steps to verify that linear history is required and/or that only squash merge and rebase merge are allowed:\n \n\n 1. On GitHub, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n 5. Ensure that **Require linear history** is checked.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.1.14",
+      "Description": "Ensure branch protection rules are enforced for administrators",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure administrators are subject to branch protection rules.",
+          "RationaleStatement": "Administrators by default are excluded from any branch protection rules. This means these privileged users (both on the repository and organization levels) are not subject to protections meant to prevent untrusted code insertion, including malicious code. This is extremely important since administrator accounts are often targeted for account hijacking due to their privileged role.",
+          "ImpactStatement": "Administrator users won't be able to push code directly to the protected branch without being compliant with listed branch protection rules.",
+          "RemediationProcedure": "For every code repository in use, enforce branch protection rules on administrators as well, by performing the following:\n \n\n 1. On GitHub, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n 5. If you add the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n 6. Select **Do not allow bypassing the above settings**.\n 7. Click **Create** or **Save changes**.",
+          "AuditProcedure": "For every code repository in use, validate branch protection rules also apply to administrator accounts by performing the next steps:\n \n\n 1. On GitHub, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n 5. Ensure that **Do not allow bypassing the above settings** is checked.",
+          "AdditionalInformation": "",
+          "References": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule"
+        }
+      ]
+    },
+    {
+      "Id": "1.1.15",
+      "Description": "Ensure pushing or merging of new code is restricted to specific individuals or teams",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.1",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure that only trusted users can push or merge new code to protected branches.",
+          "RationaleStatement": "Requiring that only trusted users may push or merge new changes reduces the risk of unverified code, especially malicious code, to a protected branch by reducing the number of trusted users who are capable of doing such.",
+          "ImpactStatement": "Only administrators and trusted users can push or merge to the protected branch.",
+          "RemediationProcedure": "For every code repository in use, allow only trusted and responsible users to push or merge new code by performing the following:\n \n\n 1. On GitHub, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4.Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n 5. If you add the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n 6. Select **Restrict who can push to matching branches** and choose trusted and responsible users and teams who will have the permission to do so. \n 7. Click **Create** or **Save changes**.",
+          "AuditProcedure": "For every code repository in use, ensure only trusted and responsible users can push or merge new code by performing the following:\n \n\n 1. On GitHub, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n 5. Ensure that **Restrict who can push to matching branches** is checked and that only trusted and responsible users and teams are selected.",
+          "AdditionalInformation": "",
+          "References": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule"
+        }
+      ]
+    },
+    {
+      "Id": "1.1.16",
+      "Description": "Ensure force push code to branches is denied",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "The \"Force Push\" option allows users with \"Push\" permissions to force their changes directly to the branch without a pull request, and thus should be disabled.",
+          "RationaleStatement": "The \"Force Push\" option allows users to override the existing code with their own code. This can lead to both intentional and unintentional data loss, as well as data infection with malicious code. Disabling the \"Force Push\" option prohibits users from forcing their changes to the master branch, which ultimately prevents malicious code from entering source code.",
+          "ImpactStatement": "Users cannot force push to protected branches.",
+          "RemediationProcedure": "For each repository in use, block the option to \"Force Push\" code by performing the following: \n \n\n 1. On GitHub, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n 5. If you add the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n 6. Uncheck **Allow force pushes**.\n 7. Click **Create** or **Save changes**.",
+          "AuditProcedure": "For every code repository in use, validate that no one can force push code by performing the following:\n \n\n 1. On GitHub, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n 5. Ensure that **Allow force pushes** is not checked.",
+          "AdditionalInformation": "",
+          "References": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule"
+        }
+      ]
+    },
+    {
+      "Id": "1.1.17",
+      "Description": "Ensure branch deletions are denied",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure that users with only push access are incapable of deleting a protected branch.",
+          "RationaleStatement": "When enabling deletion of a protected branch, any user with at least push access to the repository can delete a branch. This can be potentially dangerous, as a simple human mistake or a hacked account can lead to data loss if a branch is deleted. It is therefore crucial to prevent such incidents by denying protected branch deletion.",
+          "ImpactStatement": "Protected branches cannot be deleted.",
+          "RemediationProcedure": "For each repository that is being used, block the option to delete protected branches by performing the following:\n \n\n 1. On GitHub, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n 5. If you add the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n 6. Uncheck **Allow deletions**.\n 7. Click **Create** or **Save changes**.",
+          "AuditProcedure": "For each repository that is being used, verify that protected branches cannot be deleted by performing the following:\n \n\n 1. On GitHub, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n 5. Ensure that **Allow deletions** is not checked.",
+          "AdditionalInformation": "",
+          "References": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule"
+        }
+      ]
+    },
+    {
+      "Id": "1.1.18",
+      "Description": "Ensure any merging of code is automatically scanned for risks",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure that every pull request is required to be scanned for risks.",
+          "RationaleStatement": "Scanning pull requests to detect risks allows for early detection of vulnerable code and/or dependencies and helps mitigate potentially malicious code.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For every repository in use, enforce risk scanning on every pull request by performing the following:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Actions**.\n 3. If the repository already has at least one workflow set up and running, click **New workflow** and go to step 5. If there are currently no workflows configured for the repository, go to the next step.\n 4. Scroll down to the \"Security\" category and click **Configure** under the workflow you want to configure or click **View all** to see all available security workflows.\n 5. On the right pane of the workflow page, click **Documentation** and follow the on-screen instructions to tailor the workflow to your needs.",
+          "AuditProcedure": "For each repository in use, ensure that every pull request must be scanned for risks by performing the following:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Actions**.\n 3. Ensure that at least one workflow is configured to run like that: \n ```\n on:\n  push:\n  branches: [ \"main\" ]\n  pull_request:\n  branches: [ \"main\" ]\n ```\n and that it has a step that runs code scanning on the code.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.1.19",
+      "Description": "Ensure any changes to branch protection rules are audited",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure that changes in the branch protection rules are audited.",
+          "RationaleStatement": "Branch protection rules should be configured on every repository. The only users who may change such rules are administrators. In a case of an attack on an administrator account or of human error on the part of an administrator, protection rules could be disabled, and thus decrease source code confidentiality as a result. It is important to track and audit such changes to prevent potential incidents as soon as possible.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Use the audit log to audit changes in branch protection rules by performing the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Archives\" section of the sidebar, click **Logs**, then click **Audit log**.\n 4. Use the action qualifier in your query and look for **protected_branch** category. Ensure every action is reasonable and secure and investigate if not.",
+          "AuditProcedure": "Ensure changes in branch protection rules are audited by performing the following regularly:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Archives\" section of the sidebar, click **Logs**, then click **Audit log**.\n 4. Use the action qualifier in your query and look for **protected_branch** category. Ensure every action is reasonable and secure and is investigated if not.",
+          "AdditionalInformation": "",
+          "References": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches"
+        }
+      ]
+    },
+    {
+      "Id": "1.1.20",
+      "Description": "Ensure branch protection is enforced on the default branch",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Enforce branch protection on the default and main branch.",
+          "RationaleStatement": "The default or main branch of repositories is considered very important, as it is eventually gets deployed to the production. Therefore it needs protection. By enforcing branch protection rules on this branch, it is secured from unwanted or unauthorized changes. It can also be protected from untested and unreviewed changes and more.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Perform the following to enforce branch protection on the main branch:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Next to \"Branch protection rules\", click **Add rule**.\n 5. Under \"Branch name pattern\", type the branch name or pattern you want to protect. Ensure it applies to the main branch name.\n 6. Configure policies you want.\n 7. Click Create.",
+          "AuditProcedure": "Perform the following to ensure branch protection is enforced on the main branch:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n 4. Under **Branch protection rules**, verify that there is a rule applied to the \"main\" or default branch.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.2.1",
+      "Description": "Ensure all public repositories contain a SECURITY.md file",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "A SECURITY.md file is a security policy file that offers instruction on reporting security vulnerabilities in a project. When someone creates an issue within a specific project, a link to the SECURITY.md file will subsequently be shown.",
+          "RationaleStatement": "A SECURITY.md file provides users with crucial security information. It can also serve an important role in project maintenance, encouraging users to think ahead about how to properly handle potential security issues, updates, and general security practices.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Enforce that each public repository has a SECURITY.md file by performing the following:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under the repository name, click **Security**.\n 3. In the left sidebar, click **Security policy**.\n 4. Click **Start setup**.\n 5. In the new SECURITY.md file, add information about supported versions of your project and how to report a vulnerability.\n 6. At the bottom of the page, type a commit message.\n 7. Below the commit message fields, choose to create a new branch for your commit and then create a pull request.\n 8. Click **Propose file change**.",
+          "AuditProcedure": "Verify that each public repository has a SECURITY.md file by performing the following:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under the repository name, click **Security**.\n 3. Verify that **Security policy** is enabled.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.2.2",
+      "Description": "Ensure repository creation is limited to specific members",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Limit the ability to create repositories to trusted users and teams.",
+          "RationaleStatement": "Restricting repository creation to trusted users and teams is recommended in order to keep the organization properly structured, track fewer items, prevent impersonation, and to not overload the version-control system. It will allow administrators easier source code tracking and management capabilities, as they will have fewer repositories to track. The process of detecting potential attacks also becomes far more straightforward, as well, since the easier it is to track the source code, the easier it is to detect malicious acts within it. Additionally, the possibility of a member creating a public repository and sharing the organization's data externally is significantly decreased.",
+          "ImpactStatement": "Specific users will not be permitted to create repositories.",
+          "RemediationProcedure": "Restrict repository creation to trusted users and teams only by performing the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Access\" section of the sidebar, click **Member privileges**.\n 4. Under \"Repository creation\", unselect both options - **Public** and **Private**.\n 5. Click **Save**.",
+          "AuditProcedure": "Verify that only trusted users and teams can create repositories by performing the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Access\" section of the sidebar, click **Member privileges**.\n 4. Under \"Repository creation\", ensure that **Public** and **Private** are not checked. This means only owners are able to create repositories.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.2.3",
+      "Description": "Ensure repository deletion is limited to specific users",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure only a limited number of trusted users can delete repositories.",
+          "RationaleStatement": "Restricting the ability to delete repositories protects the organization from intentional and unintentional data loss. This ensures that users cannot delete repositories or cause other potential damage — whether by accident or due to their account being hacked — unless they have the correct privileges.",
+          "ImpactStatement": "Certain users will not be permitted to delete repositories.",
+          "RemediationProcedure": "Enforce repository deletion by a few trusted and responsible users only by performing either of the following steps:\n \n\n If Your organizations > Settings > Access > Member privileges > Allow members to delete or transfer repositories for this organization is selected, allow only trusted members to have admin privileges:\n 1. In every repository, on GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings** and then in the \"Access\" section of the sidebar, click **Collaborators & teams**.\n 3. Under \"Manage access\" use the dropdown **Role** menu to filter and search for admin members. Change their role by clicking the **Role** dropdown next to the username until there are only two trusted and qualified users with admin privileges. \n \n\n If it is not selected, allow only trusted users to become an organization owner:\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Click the name of your organization and under your organization name, click **People**.\n 3. You will see a list of the people in your organization. Click Role and select Owners. Check every member you want to change permissions to. Above the list of members, use the drop-down menu and click Change role and choose Member > change role. Do that until there are only a few trusted and qualified users with organization owner privileges. \n \n\n In any case, only members with administrator or organization owner privileges can delete repositories, regardless of your setting.",
+          "AuditProcedure": "Verify that only a limited number of trusted users can delete repositories by performing either of the following steps:\n \n\n If Your organizations > Settings > Access > Member privileges > Allow members to delete or transfer repositories for this organization is selected, verify that every admin member is trusted by you:\n 1. In every repository, on GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings** and then in the \"Access\" section of the sidebar, click **Collaborators & teams**.\n 3. Under \"Manage access\" use the dropdown **Role** menu to filter and search for admin members. Verify that there are only two of them and that they are trusted and qualified. \n \n\n If it is not selected, verify that every organization owner is trusted by you:\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Click the name of your organization and under your organization name, click **People**.\n 3. You will see a list of the people in your organization. Click Role and select Owners. Verify that there are only a few of them and that they are trusted and qualified. \n \n\n In any case, only members with administrator or organization owner privileges can delete repositories, regardless of your setting.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.2.4",
+      "Description": "Ensure issue deletion is limited to specific users",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure only trusted and responsible users can delete issues.",
+          "RationaleStatement": "Issues are a way to keep track of things happening in repositories, such as setting new milestones or requesting urgent fixes. Deleting an issue is not a benign activity, as it might harm the development workflow or attempt to hide malicious behavior. Because of this, it should be restricted and allowed only by trusted and responsible users.",
+          "ImpactStatement": "Certain users will not be permitted to delete issues.",
+          "RemediationProcedure": "Restrict issue deletion to a few trusted and responsible users only by performing either of the following steps:\n \n\n If Your organizations > Settings > Access > Member privileges > Allow members to delete issues for this organization is selected, allow only trusted members to have admin privileges:\n 1. In every repository, on GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings** and then in the \"Access\" section of the sidebar, click **Collaborators & teams**.\n 3. Under \"Manage access\" use the dropdown **Role** menu to filter and search for admin members. Change their role by clicking the **Role** dropdown next to the username until there are only two trusted and qualified users with admin privileges.\n \n\n If it is not selected, allow only trusted users to become an organization owner:\n 1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations.\n 2. Click the name of your organization and under your organization name, click **People**.\n 3. You will see a list of the people in your organization. Click **Role** and select **Owners**. Check every member you want to change permissions to. Above the list of members, use the drop-down menu and click **Change role** and choose Member > change role. Do that until there are only a few trusted and qualified users with organization owner privileges.\n \n\n In any case, only members with administrator or organization owner privileges can delete issues, regardless of your setting.",
+          "AuditProcedure": "Verify that only a limited number of trusted users can delete issues by performing either of the following steps:\n \n\n If Your organizations > Settings > Access > Member privileges > Allow members to delete issues for this organization is selected, verify that every admin member is trusted by you:\n 1. In every repository, on GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings** and then in the \"Access\" section of the sidebar, click **Collaborators & teams**.\n 3. Under \"Manage access\" use the dropdown **Role** menu to filter and search for admin members. Verify that there are only two of them and that they are trusted and qualified.\n \n\n If it is not selected, verify that every organization owner is trusted by you:\n 1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations.\n 2. Click the name of your organization and under your organization name, click **People**.\n 3. You will see a list of the people in your organization. Click **Role** and select **Owners**. Verify that there are only a few of them and that they are trusted and qualified.\n \n\n In any case, only members with administrator or organization owner privileges can delete issues, regardless of your setting.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.2.5",
+      "Description": "Ensure all copies (forks) of code are tracked and accounted for",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Track every fork of code and ensure it is accounted for.",
+          "RationaleStatement": "A fork is a copy of a repository. On top of being a plain copy, any updates to the original repository itself can be pulled and reflected by the fork under certain conditions. A large number of repository copies (forks) become difficult to manage and properly secure. New and sensitive changes can often be pushed into a critical repository without developer knowledge of an updated copy of the very same repository. If there is no limit on doing this, then it is recommended to track and delete copies of organization repositories as needed.",
+          "ImpactStatement": "Disabling forks completely may slow down the development process as more actions will be necessary to take in order to fork a repository.",
+          "RemediationProcedure": "Track forks and examine them by performing the following on a regular basis:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Insights**.\n 3. In the left sidebar, click **Forks**.\n 4. Examine the forks listed there.",
+          "AuditProcedure": "Verify that the following steps are done regularly to track and examine forks:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Insights**.\n 3. In the left sidebar, click **Forks**.\n 4. Examine the forks listed there.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.2.6",
+      "Description": "Ensure all code projects are tracked for changes in visibility status",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure every change in visibility of projects is tracked.",
+          "RationaleStatement": "Visibility of projects determines who can access a project and/or fork it: anyone, designated users, or only members of the organization. If a private project becomes public, this may point to a potential attack, which can ultimately lead to data loss, the leaking of sensitive information, and finally to a supply chain attack. It is crucial to track these changes in order to prevent such incidents.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Track every change in project visibility and investigate if suspicious behavior occurs, by performing the following regularly:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Archives\" section of the sidebar, click **Logs**, then click **Audit log**.\n 4. Use the **repo** qualifier in your query and look for **access** category. Ensure every change is reasonable and secure and investigate if it is not.",
+          "AuditProcedure": "Ensure that every change in project visibility is tracked and investigated, by performing the following regularly:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Archives\" section of the sidebar, click **Logs**, then click **Audit log**.\n 4. Use the **repo** qualifier in your query and look for **access** category. Ensure every change is reasonable and secure and is investigated if it is not.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.2.7",
+      "Description": "Ensure inactive repositories are reviewed and archived periodically",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Track inactive repositories and remove them periodically.",
+          "RationaleStatement": "Inactive repositories (i.e., no new changes introduced for a long period of time) can enlarge the surface of a potential attack or data leak. These repositories are more likely to be improperly managed, and thus could possibly be accessed by a large number of users in an organization.",
+          "ImpactStatement": "Bug fixes and deployment of necessary changes could prove complicated for archived repositories.",
+          "RemediationProcedure": "Perform the following to review all inactive repositories and archive them periodically:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Click on your organization name and then on **repositories**.\n 3. Ensure every repository listed has been active in the last 3 to 6 months. Every repository that isn't active you should either review or archive by performing the next steps:\n  1. On GitHub.com, navigate to the main page of the repository.\n  2. Under your repository name, click **Settings**.\n  3. Under \"Danger Zone\", click **Archive this repository**.\n  4. Read the warnings.\n  5. Type the name of the repository you want to archive.\n  6. Click **I understand the consequences, archive this repository**.",
+          "AuditProcedure": "Perform the following to ensure that all the repositories in the organization are active, and those that are not reviewed or archived:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Click on your organization name and then on **repositories**.\n 3. Ensure every repository listed has been active in the last 3 to 6 months. If it's not, then ensure it is archived or reviewed regularly.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.3.1",
+      "Description": "Ensure inactive users are reviewed and removed periodically",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.3",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Track inactive user accounts and periodically remove them.",
+          "RationaleStatement": "User accounts that have been inactive for a long period of time are enlarging the surface of attack. Inactive users with high-level privileges are of particular concern, as these accounts are more likely to be targets for attackers. This could potentially allow access to large portions of an organization should such an attack prove successful. It is recommended to remove them as soon as possible in order to prevent this.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "If you have GitHub AE, perform the following to review inactive user accounts and remove them:\n \n\n 1. From an administrative account on GitHub AE, in the upper-right corner of any page, click the rocket icon.\n 2. If you're not already on the \"Site admin\" page, in the upper-left corner, click **Site admin**.\n 3. In the left sidebar, click **Dormant users**.\n 4. Find the users listed there under **Your organizations** > your organization > **People** and select them.\n 5. Click **Remove from organization** and **Remove members**.\n \n\n If you have GitHub Enterprise Cloud, perform the following:\n \n\n 1. In the top-right corner of GitHub.com, click your profile photo, then click **Your enterprises**.\n 2. In the list of enterprises, click the enterprise you want to view.\n 3. In the enterprise account sidebar, click **Compliance**.\n 4. To download your Dormant Users (beta) report as a CSV file, under \"Other\", click **Download**.\n 5. Find the users listed in the file under **Your organizations** > your organization > **People** and select them.\n 6. Click **Remove from organization** and **Remove members**.",
+          "AuditProcedure": "If you have GitHub AE, verify that all user accounts are active by performing the following:\n \n\n 1. From an administrative account on GitHub AE, in the upper-right corner of any page, click the rocket icon.\n 2. If you're not already on the \"Site admin\" page, in the upper-left corner, click **Site admin**.\n 3. In the left sidebar, click **Dormant users**.\n 4. Verify that the list is empty.\n \n\n If you have GitHub Enterprise Cloud, perform the following:\n \n\n 1. In the top-right corner of GitHub.com, click your profile photo, then click **Your enterprises**.\n 2. In the list of enterprises, click the enterprise you want to view.\n 3. In the enterprise account sidebar, click **Compliance**.\n 4. To download your Dormant Users (beta) report as a CSV file, under \"Other\", click **Download**.\n 5. Verify that there are no users listed.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.3.2",
+      "Description": "Ensure team creation is limited to specific members",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.3",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Limit ability to create teams to trusted and specific users.",
+          "RationaleStatement": "The ability to create new teams should be restricted to specific members in order to keep the organization orderly and ensure users have access to only the lowest privilege level necessary. Teams typically inherit permissions from their parent team, thus if base permissions are less restricted and any user has the ability to create a team, a permission leverage could occur in which certain data is made available to users who should not have access to it. Such a situation could potentially lead to the creation of shadow teams by an attacker. Restricting team creation will also reduce additional clutter in the organizational structure, and as a result will make it easier to track changes and anomalies.",
+          "ImpactStatement": "Only specific users will be able to create new teams.",
+          "RemediationProcedure": "For every organization, limit team creation to specific, trusted users by performing the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Access\" section of the sidebar, click **Member privileges**.\n 4. Under \"Team creation rules\", deselect **Allow members to create teams**.\n 5. Click **Save**.",
+          "AuditProcedure": "For every organization, ensure that team creation is limited to specific, trusted users by performing the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Access\" section of the sidebar, click **Member privileges**.\n 4. Under \"Team creation rules\", verify that **Allow members to create teams** is not selected.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.3.3",
+      "Description": "Ensure minimum number of administrators are set for the organization",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.3",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure the organization has a minimum number of administrators.",
+          "RationaleStatement": "Organization administrators have the highest level of permissions, including the ability to add/remove collaborators, create or delete repositories, change branch protection policy, and convert to a publicly-accessible repository. Due to the permissive access granted to an organization administrator, it is highly recommended to keep the number of administrator accounts as minimal as possible.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Set the minimum number of administrators in your organization by performing the following:\n \n\n 1. In the top right corner of GitHub, click your profile photo, then click **Your profile**.\n 2. On the left side of your profile page, under \"Organizations\", click the icon for your organization.\n 3. Under your organization name, click **People**. \n 4. In the Role drop-down, choose **Owners**.\n 5. Select the person or people you'd like to remove from owner role.\n 6. Above the list of members, use the drop-down menu and click Change role.\n 7. Select **Member**, then click **Change role**.",
+          "AuditProcedure": "Verify the minimum number of administrators in your organization by performing the following:\n \n\n 1. In the top right corner of GitHub, click your profile photo, then click **Your profile**.\n 2. On the left side of your profile page, under \"Organizations\", click the icon for your organization.\n 3. Under your organization name, click **People**. \n 4. In the Role drop-down, choose **Owners**.\n 5. If there are minimum number of members in the list, you are compliant.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.3.4",
+      "Description": "Ensure Multi-Factor Authentication (MFA) is required for contributors of new code",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.3",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Require collaborators from outside the organization to use Multi-Factor Authentication (MFA) in addition to a standard user name and password when authenticating to the source code management platform.",
+          "RationaleStatement": "By default every user authenticates within the system by password only. If the password of a user is compromised, however, the user account and every repository to which they have access are in danger of data loss, malicious code commits, and data theft. It is therefore recommended that each user has Multi-Factor Authentication enabled. This adds an additional layer of protection to ensure the account remains secure even if the user's password is compromised.",
+          "ImpactStatement": "A member without enabled Multi-Factor Authentication cannot contribute to the project. They must enable Multi-Factor Authentication a before they can contribute any code.",
+          "RemediationProcedure": "For each repository in use, enforce Multi-Factor Authentication is the only way to authenticate for contributors, by doing the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Security\" section of the sidebar, click **Authentication security**.\n 4. Under \"Authentication\", select **Require two-factor authentication for everyone in your organization**, then click **Save**.",
+          "AuditProcedure": "For each repository in use, verify that Multi-Factor Authentication is enforced for contributors and is the only way to authenticate, by doing the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Security\" section of the sidebar, click **Authentication security**.\n 4. Under \"Authentication\", check if **Require two-factor authentication for everyone in your organization** is checked. If so, you are compliant.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.3.5",
+      "Description": "Ensure the organization is requiring members to use Multi-Factor Authentication (MFA)",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.3",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Require members of the organization to use Multi-Factor Authentication (MFA) in addition to a standard user name and password when authenticating to the source code management platform.",
+          "RationaleStatement": "By default every user authenticates within the system by password only. If the password of a user is compromised, however, the user account and every repository to which they have access are in danger of data loss, malicious code commits, and data theft. It is therefore recommended that each user has Multi-Factor Authentication enabled. This adds an additional layer of protection to ensure the account remains secure even if the user's password is compromised.",
+          "ImpactStatement": "Members will be removed from the organization if they don't have Multi-Factor Authentication already enabled. If this is the case, it is recommended that an invitation be sent to reinstate the user's access and former privileges. They must enable Multi-Factor Authentication to accept the invitation.",
+          "RemediationProcedure": "For every organization that exists in your GitHub platform, enforce Multi-Factor Authentication and define it as the only way to authenticate, by doing the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Security\" section of the sidebar, click **Authentication security**.\n 4. Under \"Authentication\", select **Require two-factor authentication for everyone in your organization**, then click **Save**.\n 5. If prompted, read the information about members and outside collaborators who will be removed from the organization. Type your organization's name to confirm the change, then click **Remove members & require two-factor authentication**.",
+          "AuditProcedure": "For every organization that exists in your GitHub platform, verify that Multi-Factor Authentication is enforced and is the only way to authenticate, by doing the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Security\" section of the sidebar, click **Authentication security**.\n 4. Under \"Authentication\", check if **Require two-factor authentication for everyone in your organization** is checked. If so, you are compliant.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.3.6",
+      "Description": "Ensure new members are required to be invited using company-approved email",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.3",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Existing members of an organization can invite new members to join, however new members must only be invited with their company-approved email.",
+          "RationaleStatement": "Ensuring new members of an organization have company-approved email prevents existing members of the organization from inviting arbitrary new users to join. Without this verification, they can invite anyone who is using the organization's version control system or has an active email account, thus allowing outside users (and potential threat actors) to easily gain access to company private code and resources. This practice will subsequently reduce the chance of human error or typos when inviting a new member.",
+          "ImpactStatement": "Existing members would not be able to invite new users who do not have a company-approved email address.",
+          "RemediationProcedure": "For each organization, allow only users with company-approved email to be invited. If a user was invited without company-approved email, perform the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Click the name of your organization and under your organization name, click **People**.\n 3. On the People tab, click **Invitations**. Next to the username or email address of the person whose invitation you'd like to cancel, click **Edit invitation**.\n 4. To cancel the user's invitation to join your organization, click **Cancel invitation**.",
+          "AuditProcedure": "For each organization in use, verify for every invitation that the invited email address is company-approved by performing the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Click the name of your organization and under your organization name, click **People**.\n 3. On the People tab, click **Invitations**. Verify that each invitation email is company approved by your company.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.3.7",
+      "Description": "Ensure two administrators are set for each repository",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.3",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure every repository has two users with administrative permissions.",
+          "RationaleStatement": "Repository administrators have the highest permissions to said repository. These include the ability to add/remove collaborators, change branch protection policy, and convert to a publicly-accessible repository. Due to the liberal access granted to a repository administrator, it is highly recommended that only two contributors occupy this role.",
+          "ImpactStatement": "Removing administrative users from a repository would result in them losing high-level access to that repository.",
+          "RemediationProcedure": "For every repository in use, set two administrators by performing the following:\n \n\n 1. On GitHub, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Access\" section of the sidebar, click **Collaborators & teams**.\n 4. Under **Manage access**, find the team or person whose you'd like to revoke admin permissions, then select the Role drop-down and click a new role.",
+          "AuditProcedure": "For every repository in use, verify there are two administrators by performing the following:\n \n\n 1. On GitHub, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Access\" section of the sidebar, click **Collaborators & teams**.\n 4. Under **Manage access**, verify that there are only 2 members with Admin permission.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.3.8",
+      "Description": "Ensure strict base permissions are set for repositories",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.3",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Base permissions define the permission level automatically granted to all organization members. Define strict base access permissions for all of the repositories in the organization, including new ones.",
+          "RationaleStatement": "Defining strict base permissions is the best practice in every role-based access control (RBAC) system. If the base permission is high — for example, \"write\" permission — every member of the organization will have \"write\" permission to every repository in the organization. This will apply regardless of the specific permissions a user might need, which generally differ between organization repositories. The higher the permission, the higher the risk for incidents such as bad code commit or data breach. It is therefore recommended to set the base permissions to the strictest level possible.",
+          "ImpactStatement": "Users might not be able to access organization repositories or perform some acts as commits. These specific permissions should be granted individually for each user or team, as needed.",
+          "RemediationProcedure": "Set strict base permissions for the organization repositories with the next steps:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Access\" section of the sidebar, click **Member privileges**.\n 4. Under \"Base permissions\", use the drop-down to select new base permissions - \"Read\" or \"None\".\n 5. Review the changes. To confirm, click **Change default permission to PERMISSION**.",
+          "AuditProcedure": "Verify that strict base permissions are set for the organization repositories by doing the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Access\" section of the sidebar, click **Member privileges**.\n 4. Under \"Base permissions\", verify that it is set to \"Read\" or \"None\". If it does, you are compliant.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.3.9",
+      "Description": "Ensure an organization’s identity is confirmed with a “Verified” badge",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.3",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Confirm the domains an organization owns with a \"Verified\" badge.",
+          "RationaleStatement": "Verifying the organization's domain gives developers assurance that a given domain is truly the official home for a public organization. Attackers can pretend to be an organization and steal information via a faked/spoof domain, therefore the use of a \"Verified\" badge instills more confidence and trust between developers and the open-source community.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Only if you have an enterprise account, verify the organization's domains and secure a \"Verified\" badge next to its name by performing the following:\n \n\n 1. In the top-right corner of GitHub.com, click your profile photo, then click **Your enterprises**.\n 2. In the list of enterprises, click the enterprise you want to view. Then in the enterprise account sidebar, click **Settings**.\n 3. Under \"Settings\", click **Verified & approved domains**.\n 4. Click **Add a domain**.\n 5. In the domain field, type the domain you'd like to verify, then click **Add domain**.\n 6. Follow the instructions under **Add a DNS TXT record** to create a DNS TXT record with your domain hosting service. Wait for your DNS configuration to change, which may take up to 72 hours. You can confirm your DNS configuration has changed by running the `dig` command on the command line, replacing ENTERPRISE-ACCOUNT with the name of your enterprise account, and example.com with the domain you'd like to verify. You should see your new TXT record listed in the command output.\n ```\n dig _github-challenge-ENTERPRISE-ACCOUNT.DOMAIN-NAME +nostats +nocomments +nocmd TXT\n ```\n 7. After confirming your TXT record is added to your DNS, follow steps one through three above to navigate to your enterprise account's approved and verified domains.\n 8. To the right of the domain that's pending verification, click the 3-dots, then click **Continue verifying**. Click **Verify**.\n 9. Optionally, after the \"Verified\" badge is visible on your organizations' profiles, delete the TXT entry from the DNS record at your domain hosting service.",
+          "AuditProcedure": "Only if you have an enterprise account, view the enterprise organization profile page and ensure it has a \"Verified\" badge in it.",
+          "AdditionalInformation": "",
+          "References": "https://docs.github.com/en/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization"
+        }
+      ]
+    },
+    {
+      "Id": "1.3.10",
+      "Description": "Ensure Source Code Management (SCM) email notifications are restricted to verified domains",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.3",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Restrict the Source Code Management (SCM) organization's email notifications to approved domains only.",
+          "RationaleStatement": "Restricting Source Code Management email notifications to verified domains only prevents data leaks, as personal emails and custom domains are more prone to account takeover via DNS hijacking or password breach.",
+          "ImpactStatement": "Only members with approved email would be able to receive Source Code Management notifications.",
+          "RemediationProcedure": "Only if you have an enterprise account, restrict Source Code Management email notifications to approved domains only by performing the following:\n \n\n 1. In the top-right corner of GitHub.com, click your profile photo, then click **Your enterprises**.\n 2. In the list of enterprises, click the enterprise you want to view. Then in the enterprise account sidebar, click **Settings**.\n 3. Under \"Settings\", click **Verified & approved domains**.\n 4. Under \"Notification preferences\", select **Restrict email notifications to only approved or verified domains**.\n 5. Click **Save**.",
+          "AuditProcedure": "Only if you have an enterprise account, ensure Source Code Management email notifications are restricted to approved domains only by performing the following:\n \n\n 1. In the top-right corner of GitHub.com, click your profile photo, then click **Your enterprises**.\n 2. In the list of enterprises, click the enterprise you want to view. Then in the enterprise account sidebar, click **Settings**.\n 3. Under \"Settings\", click **Verified & approved domains**.\n 4. Under \"Notification preferences\", verify that **Restrict email notifications to only approved or verified domains** is selected.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.3.11",
+      "Description": "Ensure an organization provides SSH certificates",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.3",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "As an organization, become an SSH Certificate Authority and provide SSH keys for accessing repositories.",
+          "RationaleStatement": "There are two ways for remotely working with Source Code Management: via HTTPS, which requires authentication by user/password, or via SSH, which requires the use of SSH keys. SSH authentication is better in terms of security; key creation and distribution, however, must be done in a secure manner. This can be accomplished by implementing SSH certificates, which are used to validate the server's identity. A developer will not be able to connect to a Git server if its key cannot be verified by the SSH Certificate Authority (CA) server.\n As an organization, one can verify the SSH certificate signature used to authenticate if a CA is defined and used. This ensures that only verified developers can access organization repositories, as their SSH key will be the only one signed by the CA certificate. This reduces the risk of misuse and malicious code commits.",
+          "ImpactStatement": "Members with unverified keys will not be able to clone organization repositories. Signing, certification, and verification might also slow down the development process.",
+          "RemediationProcedure": "Only if you have an enterprise account, deploy an SSH Certificate Authority server and configure it to provide an SSH certificate with which to sign keys by performing the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Security\" section of the sidebar, click **Authentication security**.\n 4. To the right of \"SSH Certificate Authorities\", click **New CA**.\n 5. Under \"Key,\" paste your public SSH key.\n 6. Click **Add CA**.\n 7. Click **Save**.",
+          "AuditProcedure": "Only if you have an enterprise account, verify that the enterprise organization has an SSH Certificate Authority server and provides an SSH certificate with which to sign keys by performing the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Security\" section of the sidebar, click **Authentication security**.\n 4. Verify that there's an SSH certificate authority listed there.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.3.12",
+      "Description": "Ensure Git access is limited based on IP addresses",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.3",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Limit Git access based on IP addresses by having a allowlist of IP addresses from which connection is possible.",
+          "RationaleStatement": "Allowing access to Git repositories (source code) only from specific IP addresses adds yet another layer of restriction and reduces the risk of unauthorized connection to the organization's assets. This will prevent attackers from accessing Source Code Management (SCM), as they would first need to know the allowed IP addresses to gain access to them.",
+          "ImpactStatement": "Only members with allowlisted IP addresses will be able to access the organization's Git repositories.",
+          "RemediationProcedure": "Only if you have an enterprise account, create an IP allowlist and forbid all other IPs from accessing the source code by performing the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Security\" section of the sidebar, click **Authentication security**.\n 4. At the bottom of the \"IP allow list\" section, enter an IP address, or a range of addresses in CIDR notation. Optionally, enter a description of the allowed IP address or range.\n 5. Click **Add**.\n 6. After that, under \"IP allow list\", select **Enable IP allow list**.\n 7. Click **Save**.",
+          "AuditProcedure": "Only if you have an enterprise account, in every organization of yours, ensure access is allowed only by IP allowlist, and that access is forbidden for all other IPs by performing the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Security\" section of the sidebar, click **Authentication security**.\n 4. Verify that there's an IP address, or a range of addresses in CIDR notation listed. Also verify that **Enable IP allow list** is selected.",
+          "AdditionalInformation": "",
+          "References": "https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-allowed-ip-addresses-for-your-organization"
+        }
+      ]
+    },
+    {
+      "Id": "1.3.13",
+      "Description": "Ensure anomalous code behavior is tracked",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.3",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Track code anomalies.",
+          "RationaleStatement": "Carefully analyze any code anomalies within the organization. For example, a code anomaly could be a push made outside of working hours. Such a code push has a higher likelihood of being the result of an attack, as most if not all members of the organization would likely be outside the office. Another example is an activity that exceeds the average activity of a particular user.\n Tracking and auditing such behaviors creates additional layers of security and can aid in early detection of potential attacks.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For every repository in use, track and investigate anomalous code behavior and activity.",
+          "AuditProcedure": "For every repository in use, ensure code anomalies relevant to the organization are promptly investigated.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.4.1",
+      "Description": "Ensure administrator approval is required for every installed application",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.4",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure an administrator approval is required when installing applications.",
+          "RationaleStatement": "Applications are typically automated integrations that improve the workflow of an organization. They are written by third-party developers, and therefore should be validated before using in case they're malicious or not trustable. Because administrators are expected to be the most qualified and trusted members of the organization, they should review the applications being installed and decide whether they are both trusted and necessary.",
+          "ImpactStatement": "Applications will not be installed without administrator approval.",
+          "RemediationProcedure": "Require an administrator approval for every installed application:\n \n\n a. For GitHub Apps, you are compliant by default. That is because by default only organization owners and administrators can install them.\n \n\n b. For OAuth Apps, perform the following:\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Third-party Access\" section of the sidebar, click **OAuth application policy**.\n 4. Under \"Third-party application access policy\", click **Setup application access restrictions**.\n 5. After you review the information about third-party access restrictions, click **Restrict third-party application access**.",
+          "AuditProcedure": "Verify that applications are installed only after receiving administrator approval:\n \n\n a. For GitHub Apps, you are compliant by default. That is because by default only organization owners and administrators can install them.\n \n\n b. For OAuth Apps, perform the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Third-party Access\" section of the sidebar, click **OAuth application policy**.\n 4. Under \"Third-party application access policy\" verify that the policy status is **Access restricted**.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.4.2",
+      "Description": "Ensure stale applications are reviewed and inactive ones are removed",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.4",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure stale (inactive) applications are reviewed and removed if no longer in use.",
+          "RationaleStatement": "Applications that have been inactive for a long period of time are enlarging the surface of attack for data leaks. They are more likely to be improperly managed, and could possibly be accessed by third-party developers as a tool for collecting internal data of the organization or repository in which they are installed. It is important to remove these inactive applications as soon as possible.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Review all stale applications and periodically remove them.",
+          "AuditProcedure": "Verify that all the applications in the organization are actively used, and remove those that are no longer in use.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.4.3",
+      "Description": "Ensure the access granted to each installed application is limited to the least privilege needed",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.4",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure installed application permissions are limited to the lowest privilege level required.",
+          "RationaleStatement": "Applications are typically automated integrations that can improve the workflow of an organization. They are written by third-party developers, and therefore should be reviewed carefully before use. It is recommended to use the \"least privilege\" principle, granting applications the lowest level of permissions required. This may prevent harm from a potentially malicious application with unnecessarily high-level permissions leaking data or modifying source code.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Grant permissions to applications by the \"least privilege\" principle, meaning the lowest possible permission necessary:\n \n\n a. For GitHub Apps, perform the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Integrations\" section of the sidebar, click **GitHub Apps**.\n 4. Next to every GitHub App, click **Configure**.\n 5. Review the GitHub App's permissions and repository access. Edit the permissions granted to the least possible. For example, restrict the number of repositories the App can access.\n 6. Click **Save**.",
+          "AuditProcedure": "Verify that each installed application has the least privilege needed:\n \n\n a. For GitHub Apps, perform the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the \"Integrations\" section of the sidebar, click **GitHub Apps**.\n 4. Next to every GitHub App, click **Configure**.\n 5. Review the GitHub App's permissions and repository access. Verify that the App permissions are the least possible and that it can access only necessary repositories.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.4.4",
+      "Description": "Ensure only secured webhooks are used",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.4",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Use only secured webhooks in the source code management platform.",
+          "RationaleStatement": "A webhook is an event listener, attached to critical and sensitive parts of the software delivery process. It is triggered by a list of events (such as a new code being committed), and when triggered, the webhook sends out a notification with some payload to specific internet endpoints. Since the payload of the webhook contains sensitive organization data, it's important all webhooks are directed to an endpoint (URL) protected by SSL verification (HTTPS). This helps ensure that the data sent is delivered to securely without any man-in-the-middle, who could easily access and even alter the payload of the request.",
+          "ImpactStatement": "Perform the following to ensure all webhooks used are secured (HTTPS):\n \n\n 1. Navigate to your organization or repository and select **Settings**.\n 2. Select **Webhooks** on the side menu.\n 3. Verify that each webhook URL starts with 'https'.",
+          "RemediationProcedure": "Perform the following to secure all webhooks used(over HTTPS):\n \n\n 1. Navigate to your organization or repository and select **Settings**.\n 2. Select **Webhooks** on the side menu.\n 3. Find the webhooks that starts with 'http' and not 'https'.\n 4. Ensure the endpoint (URL) of the webhook listens to secured port (443) and uses certificate.\n 5. Click **Edit**.\n 6. Change the payload URL to https and ensure **Enable SSL verification** is checked.\n 7. Click **Update webhook**.",
+          "AuditProcedure": "Perform the following to secure all webhooks used(over HTTPS):\n \n\n 1. Navigate to your organization or repository and select **Settings**.\n 2. Select **Webhooks** on the side menu.\n 3. Ensure all webhooks starts with 'https'.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.5.1",
+      "Description": "Ensure scanners are in place to identify and prevent sensitive data in code",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.5",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Detect and prevent sensitive data in code, such as confidential ID numbers, passwords, etc.",
+          "RationaleStatement": "Having sensitive data in the source code makes it easier for attackers to maliciously use such information. In order to avoid this, designate scanners to identify and prevent the existence of sensitive data in the code.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For every repository in use, designate scanners to identify and prevent sensitive data in code by performing the following (enterprise only):\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Security\" section of the sidebar, click **Code security and analysis**.\n 4. Scroll down to the bottom of the page and click **Enable** for secret scanning.",
+          "AuditProcedure": "For every repository in use, verify that scanners are set to identify and prevent the existence of sensitive data in code by performing the following (enterprise only):\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the \"Security\" section of the sidebar, click **Code security and analysis**.\n 4. Scroll down to the bottom of the page. If you see a **Disable** button, it means that secret scanning is already enabled for the repository.",
+          "AdditionalInformation": "By January 2023, this feature is supposed to be open to all plans. Until then it is only for enterprise users.",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.5.2",
+      "Description": "Ensure scanners are in place to secure Continuous Integration (CI) pipeline instructions",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.5",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Detect and prevent misconfigurations and insecure instructions in CI pipelines",
+          "RationaleStatement": "Detecting and fixing misconfigurations or insecure instructions in CI pipelines decreases the risk for a successful attack through or on the CI pipeline. The more secure the pipeline, the less risk there is for potential exposure of sensitive data, a deployment being compromised, or external access mistakenly being granted to the CI infrastructure or the source code.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Set a CI instructions scanning tool to identify and prevent misconfigurations and insecure instructions and scans all CI pipelines.",
+          "AuditProcedure": "Verify that a CI instructions scanning tool is set to identify and prevent misconfigurations and insecure instructions and that it scans all CI pipelines.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.5.3",
+      "Description": "Ensure scanners are in place to secure Infrastructure as Code (IaC) instructions",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.5",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Detect and prevent misconfigurations or insecure instructions in Infrastructure as Code (IaC) files, such as Terraform files.",
+          "RationaleStatement": "Detecting and fixing misconfigurations and/or insecure instructions in IaC (Infrastructure as Code) files decreases the risk for data leak or data theft. It is important to secure IaC instructions in order to prevent further problems of deployment, exposed assets, or improper configurations, which can ultimately lead to easier ways to attack and steal organization data.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For every repository that holds IaC instructions files, set a scanning tool to identify and prevent misconfigurations and insecure instructions.",
+          "AuditProcedure": "For every repository that holds IaC instructions files, verify that a scanning tool is set to identify and prevent misconfigurations and insecure instructions.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.5.4",
+      "Description": "Ensure scanners are in place for code vulnerabilities",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.5",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Detect and prevent known open source vulnerabilities in the code.",
+          "RationaleStatement": "Open source code blocks are used a lot in developed software. This has its own advantages, but it also has risks. Because the code is open for everyone, it means that attackers can publish or add malicious code to these open-source code blocks, or use their knowledge to find vulnerabilities in an existing code. Detecting and fixing such code vulnerabilities, by SCA (Software Composition Analysis) prevents insecure flaws from reaching production. It gives another opportunity for developers to secure the source code before it is deployed in production, where it is far more exposed and vulnerable to attacks.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For every repository that is in use, set a scanning tool to identify and prevent code vulnerabilities by performing the following:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under the repository name, click **Security**.\n 3. To the right of \"Code scanning alerts\", click **Set up code scanning**.\n 4. Under \"Get started with code scanning\", click Set up this workflow on a workflow of your choice.\n 5. To customize how code scanning scans your code, edit the workflow.\n 6. Use the **Start commit** drop-down and type a commit message.\n 7. Choose whether you'd like to commit directly to the default branch or create a new branch and start a pull request.\n 8. Click **Commit new file** or **Propose new file**.",
+          "AuditProcedure": "For every repository that is in use, verify that a scanning tool is set to identify and prevent code vulnerabilities by performing the following:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under the repository name, click **Security**.\n 3. Verify that \"Code scanning alerts\" is **Enabled** or that there is a workflow that scans your code.",
+          "AdditionalInformation": "All public repositories in all plans can use code scanning in GitHub. In private repositories, only GitHub Enterprise can use code scanning.",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.5.5",
+      "Description": "Ensure scanners are in place for open-source vulnerabilities in used packages",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.5",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Detect, prevent and monitor known open-source vulnerabilities in packages that are being used.",
+          "RationaleStatement": "Open-source vulnerabilities might exist before one starts to use a package, but they are also discovered over time. New attacks and vulnerabilities are announced every now and then. It is important to keep track of these and to monitor whether the dependencies used are affected by the recent vulnerability. Detecting and fixing those packages' vulnerabilities decreases the attack surface within deployed and running applications that use such packages. It prevents security flaws from reaching the production environment which could eventually lead to a security breach.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Set scanners that will monitor, identify, and prevent open-source vulnerabilities in packages by performing the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**. In the \"Security\" section of the sidebar, click **Code security and analysis**.\n 3. Under \"Code security and analysis\", to the right of Dependabot alerts, click **Disable all** or **Enable all**.\n 4. Check the **Enable by default for new repositories** option and then click **Enable Dependabot alerts**.\n \n\n It is also recommended to use another additional solution for package scanning because GitHub doesn't always recognize the vulnerabilities.",
+          "AuditProcedure": "Verify that scanners are set to monitor, identify, and prevent open-source vulnerabilities in packages by performing the following:\n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**. In the \"Security\" section of the sidebar, click **Code security and analysis**.\n 3. Verify that the Dependabot alerts is enabled and that **Enable by default for new repositories** is checked.\n \n\n It is also recommended to verify that you're using another additional solution for package scanning because GitHub doesn't always recognize the vulnerabilities.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "1.5.6",
+      "Description": "Ensure scanners are in place for open-source license issues in used packages",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "1.5",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Detect open-source license problems in used dependencies and fix them.",
+          "RationaleStatement": "A software license is a legal document that establishes several key conditions between a software company or developer and a user in order to allow the use of software. Software licenses have the potential to create code dependencies. Not following the conditions in the software license can also lead to lawsuits. When using packages with a software license, especially commercial ones (which are the most permissive), it is important to verify what is allowed by that license in order to be protected against lawsuits.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Designate a license scanning tool to identify open-source license problems and fix them and scan every package you use.",
+          "AuditProcedure": "Ensure a license scanning tool is set up to identify open-source license problems and that every package you use is scanned by it.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.1.1",
+      "Description": "Ensure each pipeline has a single responsibility",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.1",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure each pipeline has a single responsibility in the build process.",
+          "RationaleStatement": "Build pipelines generally have access to multiple secrets depending on their purposes. There are, for example, secrets of the test environment for the test phase, repository and artifact credentials for the build phase, etc. Limiting access to these credentials/secrets is therefore recommended by dividing pipeline responsibilities, as well as having a dedicated pipeline for each phase with the lowest privilege instead of a single pipeline for all. This will ensure that any potential damage caused by attacks on a workflow will be limited.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Divide each multi-responsibility pipeline into multiple pipelines, each having a single responsibility with the least privilege. Additionally, create all new pipelines with a sole purpose going forward.",
+          "AuditProcedure": "For each pipeline, ensure it has only one responsibility in the build process.",
+          "AdditionalInformation": "",
+          "References": "https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs"
+        }
+      ]
+    },
+    {
+      "Id": "2.1.2",
+      "Description": "Ensure all aspects of the pipeline infrastructure and configuration are immutable",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure the pipeline orchestrator and its configuration are immutable.",
+          "RationaleStatement": "An immutable infrastructure is one that cannot be changed during execution of the pipeline. This can be done, for example, by using Infrastructure as Code for configuring the pipeline and the pipeline environment. Utilizing such infrastructure creates a more predictable environment because updates will require re-deployment to prevent any previous configuration from interfering. Because it is dependent on automation, it is easier to revert changes. Testing code is also simpler because it is based on virtualization. Most importantly, an immutable pipeline infrastructure ensures that a potential attacker seeking to compromise the build environment itself would not be able to do so if the orchestrator, its configuration, and any other component cannot be changed. Verifying that all aspects of the pipeline infrastructure and configuration are immutable therefore keeps them safe from malicious tampering attempts.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Use an immutable pipeline orchestrator and ensure that its configuration and all other aspects of the built environment are immutable, as well.",
+          "AuditProcedure": "Verify that the pipeline orchestrator, its configuration, and all other aspects of the build environment are immutable.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.1.3",
+      "Description": "Ensure the build environment is logged",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Keep build logs of the build environment detailing configuration and all activity within it. Also, consider to store them in a centralized organizational log store.",
+          "RationaleStatement": "Logging the environment is important for two primary reasons: one, for debugging and investigating the environment in case of a bug or security incident; and two, for reproducing the environment easily when needed. Storing these logs in a centralized organizational log store allows the organization to generate useful insights and identify anomalies in the build process faster.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Keep logs of the build environment. For example, use the .buildinfo file for Debian build workers. Also, store the logs in a centralized organizational log store.",
+          "AuditProcedure": "Verify that the build environment is logged and stored in a centralized organizational log store.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.1.4",
+      "Description": "Ensure the creation of the build environment is automated",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Automate the creation of the build environment.",
+          "RationaleStatement": "Automating the deployment of the build environment reduces the risk for human mistakes — such as a wrong configuration or exposure of sensitive data — because it requires less human interaction and intervention. It also eases re-deployment of the environment. It is best to automate with Infrastructure as Code because it offers more control over changes made to the environment creation configuration and stores to a version control platform.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Automate the deployment of the build environment.",
+          "AuditProcedure": "Verify that the deployment of the build environment is automated and can be easily redeployed.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.1.5",
+      "Description": "Ensure access to build environments is limited",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Restrict access to the build environment (orchestrator, pipeline executor, their environment, etc.) to trusted and qualified users only.",
+          "RationaleStatement": "A build environment contains sensitive data such as environment variables, secrets, and the source code itself. Any user that has access to this environment can make changes to the build process, including changes to the code within it. Restricting access to the build environment to trusted and qualified users only will reduce the risk for mistakes such as exposure of secrets or misconfiguration. Limiting access also reduces the number of accounts that are vulnerable to hijacking in order to potentially harm the build environment.",
+          "ImpactStatement": "Reducing the number of users who have access to the build process means those users would lose their ability to make direct changes to that process.",
+          "RemediationProcedure": "Restrict access to the build environment to trusted and qualified users.",
+          "AuditProcedure": "Verify each build environment is accessible only to known and authorized users.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.1.6",
+      "Description": "Ensure users must authenticate to access the build environment",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Require users to login in to access the build environment - where the orchestrator, the pipeline executer, where the build workers are running, etc.",
+          "RationaleStatement": "Requiring users to authenticate and disabling anonymous access to the build environment allows organization to track every action on that environment, good or bad, to its actor. This will help recognizing attack and its attacker becuase the authentication is required.",
+          "ImpactStatement": "Anonymous users won't be able to access the build environment.",
+          "RemediationProcedure": "Require authentication to access the build environment and disable anonymous access.",
+          "AuditProcedure": "Ensure authentication is required to access the build environment.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.1.7",
+      "Description": "Ensure build secrets are limited to the minimal necessary scope",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.1",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Build tools providers offer a secure way to store secrets that should be used during the build process.\n These secrets will often be credentials used to access other tools, for example for pulling code or for uploading artifacts.\n Access to these secrets can be defined on various scopes, for example in github it could be on an organization level or a repository level and there is also control on whether these secrets are passed to forked pull request.\n To protect these critical assets it is important to choose the most restrictive scope necessary.",
+          "RationaleStatement": "Allowing over permissive access to these secrets may affect on their exposure.\n For example if a secret is defined in an organization level, and users can create new repositories, there is a scenario where a user can create a new repo and run a controlled build just to exfiltrate these secrets.",
+          "ImpactStatement": "Increased risk of exposure of build related secrets.",
+          "RemediationProcedure": "For each build tool, review the secrets defined and their permissions scope and change over permissive scopes to more restrictive ones based on the required access.",
+          "AuditProcedure": "For each build tool in use, review the secrets defined and the permission scopes they are assigned.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.1.8",
+      "Description": "Ensure the build infrastructure is automatically scanned for vulnerabilities",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Scan the build infrastructure and its dependencies for vulnerabilities. It is recommended that this be done automatically.",
+          "RationaleStatement": "Automatic scanning for vulnerabilities detects known vulnerabilities in the tooling used by the build infrastructure and its dependencies. These vulnerabilities can lead\n to a potentially massive breach if not handled as fast as possible, as attackers might also be\n aware of such vulnerabilities.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Set an automated vulnerability scanning for your build infrastructure.",
+          "AuditProcedure": "Verify that your build infrastructure is automatically scanned for vulnerabilities.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.1.9",
+      "Description": "Ensure default passwords are not used",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Do not use default passwords of build tools and components.",
+          "RationaleStatement": "Sometimes build tools and components are provided with default passwords for the first login. This password is intended to be used only on the first login and should be changed immediately after. Using the default password substantially increases the attack risk. It is especially important to ensure that default passwords are not used in build tools and components.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each build tool, change the default password.",
+          "AuditProcedure": "For each build tool, ensure the password used is not the default one.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.1.10",
+      "Description": "Ensure webhooks of the build environment are secured",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Use secured webhooks of the build environment.",
+          "RationaleStatement": "Webhooks are used for triggering an HTTP request based on an action made in the platform. Typically, build environment feature webhooks for a pipeline trigger based on source code event. Since webhooks are an HTTP POST request, they can be malformed if not secured over SSL. To prevent a potential hack and compromise of the webhook or to the environment or web server excepting the request, use only secured webhooks.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each webhook in use, change it to secured (over HTTPS).",
+          "AuditProcedure": "For each webhook in use, ensure it is secured (HTTPS).",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.1.11",
+      "Description": "Ensure minimum number of administrators are set for the build environment",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure the build environment has a minimum number of administrators.",
+          "RationaleStatement": "Build environment administrators have the highest level of permissions, including the ability to add/remove users, create or delete pipelines, control build workers, change build trigger permissions and more. Due to the permissive access granted to a build environment administrator, it is highly recommended to keep the number of administrator accounts as minimal as possible.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Set the minimum number of administrators in the build environment.",
+          "AuditProcedure": "Verify that the build environment has only the minimum number of administrators.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.2.1",
+      "Description": "Ensure build workers are single-used",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Use a clean instance of build worker for every pipeline run.",
+          "RationaleStatement": "Using a clean instance of build worker for every pipeline run eliminates the risks of data theft, data integrity breaches, and unavailability. It limits the pipeline's access to data stored on the file system from previous runs, and the cache is volatile. This prevents malicious changes from affecting other pipelines or the Continuous Integration/Continuous Delivery system itself.",
+          "ImpactStatement": "Data and cache will not be saved in different pipeline runs.",
+          "RemediationProcedure": "Create a clean build worker for every pipeline that is being run, or use build platform-hosted runners, as they typically offer a clean instance for every run.",
+          "AuditProcedure": "Ensure that every pipeline that is being run has its own clean, new runner.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.2.2",
+      "Description": "Ensure build worker environments and commands are passed and not pulled",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "A worker’s environment can be passed (for example, a pod in a Kubernetes cluster in which an environment variable is passed to it). It also can be pulled, like a virtual machine that is installing a package. Ensure that the environment and commands are passed to the workers and not pulled from it.",
+          "RationaleStatement": "Passing an environment means additional configuration happens in the build time phase and not in run time. It will also pass locally and not remotely. Passing a worker environment, instead of pulling it from an outer source, reduces the possibility for an attacker to gain access and potentially pull malicious code into it. By passing locally and not pulling from remote, there is also less chance of an attack based on the remote connection, such as a man-in-the-middle or malicious scripts that can run from remote. This therefore prevents possible infection of the build worker.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each build worker, pass its environment and commands to it instead of pulling it.",
+          "AuditProcedure": "For each build worker, ensure its environment and commands are passed and not pulled.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.2.3",
+      "Description": "Ensure the duties of each build worker are segregated",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Separate responsibilities in the build workflow, such as testing, compiling, pushing artifacts, etc., to different build workers so that each worker will have a single duty.",
+          "RationaleStatement": "Separating duties and allocating them to many workers makes it easier to verify each step in the build process and ensure there is no corruption. It also limits the effect of an attack on a build worker, as such an attack would be less critical if the worker has less access and duties that are subject to harm.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each build worker, limit its responsibility to one duty.",
+          "AuditProcedure": "For each build worker, ensure it has the least responsibility possible, preferably only one duty.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.2.4",
+      "Description": "Ensure build workers have minimal network connectivity",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure that build workers have minimal network connectivity.",
+          "RationaleStatement": "Restricting the network connectivity of build workers decreases the possibility that an attacker would be capable of entering the organization from the outside. If the build workers are connected to the public internet without any restriction, it is far simpler for attackers to compromise them. Limiting network connectivity between build workers also protects the organization in case an attacker was successful and subsequently attempts to spread the attack to other components of the environment.",
+          "ImpactStatement": "Developers will not have connectivity to every resource they might need from the outside. Workers will also only be able to exchange data through shareable storage.",
+          "RemediationProcedure": "Limit the network connectivity of build workers, environment, and any other components to the necessary minimum.",
+          "AuditProcedure": "Verify that build workers, environment, and any other components have only the required minimum of network connectivity.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.2.5",
+      "Description": "Ensure run-time security is enforced for build workers",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Add traces to build workers' operating systems and installed applications so that in run time, collected events can be analyzed to detect suspicious behavior patterns and malware.",
+          "RationaleStatement": "Build workers are exposed to data exfiltration attacks, code injection attacks, and more while running. It is important to secure them from such attacks by enforcing run-time security on the build worker itself. This will identify attempted attacks in real time and prevent them.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Deploy and enforce a run-time security solution on build workers.",
+          "AuditProcedure": "Verify that a run-time security solution is enforced on every active build worker.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.2.6",
+      "Description": "Ensure build workers are automatically scanned for vulnerabilities",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Scan build workers for vulnerabilities. It is recommended that this be done automatically.",
+          "RationaleStatement": "Automatic scanning for vulnerabilities detects known weaknesses in environmental sources in use, such as docker images or kernel versions. Such vulnerabilities can lead to a massive breach if these environments are not replaced as fast as possible, since attackers also know about these vulnerabilities and often try to take advantage of them. Setting automatic scanning which scans environmental sources ensures that if any new vulnerability is revealed, it can be replaced quickly and easily. This protects the worker from being exposed to attacks.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each build worker, automatically scan its environmental sources, such as docker image, for vulnerabilities.",
+          "AuditProcedure": "For each build worker, ensure the environmental sources it uses are scanned for vulnerabilities.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.2.7",
+      "Description": "Ensure build workers' deployment configuration is stored in a version control platform",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Store the deployment configuration of build workers in a version control platform, such as Github.",
+          "RationaleStatement": "Build workers are a sensitive part of the build phase. They generally have access to the code repository, the Continuous Integration platform, the deployment platform, etc. This means that an attacker gaining access to a build worker may compromise other platforms in the organization and cause a major incident. One thing that can protect workers is to ensure that their deployment configuration is safe and well-configured. Storing the deployment configuration in version control enables more observability of these configurations because everything is catalogued in a single place. It adds another layer of security, as every change will be reviewed and noticed, and thus malicious changes will theoretically occur less. In the case of a mistake, bug, or security incident, it also offers an easier way to \"revert\" back to a safe version or add a \"hot fix\" quickly.",
+          "ImpactStatement": "Changes in deployment configuration may only be applied by declaration in the version control platform. This could potentially slow down the development process.",
+          "RemediationProcedure": "Document and store every deployment configuration of build workers in a version control platform.",
+          "AuditProcedure": "Verify that the deployment configuration of build workers is stored in a version control platform.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.2.8",
+      "Description": "Ensure resource consumption of build workers is monitored",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Monitor the resource consumption of build workers and set alerts for high consumption that can lead to resource exhaustion.",
+          "RationaleStatement": "Resource exhaustion is when machine resources or services are highly consumed until exhausted. Resource exhaustion may lead to DOS (Denial of Service). When such a situation happens to build workers, it slows down and even stops the build process, which harms the production of artifacts and the organization's ability to deliver software on schedule. To prevent that, it is recommended to monitor resources consumption in the build workers and set alerts to notify when they are highly consumed. That way resource exhaustion can be acknowledged and prevented at an early stage.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Set reources consumption monitoring for each build worker.",
+          "AuditProcedure": "Verify that there is monitoring of resources consumption for each build worker.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.3.1",
+      "Description": "Ensure all build steps are defined as code",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.3",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Use pipeline as code for build pipelines and their defined steps.",
+          "RationaleStatement": "Storing pipeline instructions as code in a version control system means automation of the build steps and less room for human error, which could potentially lead to a security breach. Additionally, It creates the ability to revert back to a previous pipeline configuration in order to pinpoint the affected change should a malicious incident occur.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Convert pipeline instructions into code-based syntax and upload them to the organization's version control platform.",
+          "AuditProcedure": "Verify that all build steps are defined as code and stored in a version control system.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.3.2",
+      "Description": "Ensure steps have clearly defined build stage input and output",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.3",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Define clear expected input and output for each build stage.",
+          "RationaleStatement": "In order to have more control over data flow in the build pipeline, clearly define the input and output of the pipeline steps. If anything malicious happens during the build stage, it will be recognized more easily and stand out as an anomaly.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each build stage, clearly define what is expected for input and output.",
+          "AuditProcedure": "For each build stage, verify that the expected input and output are clearly defined.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.3.3",
+      "Description": "Ensure output is written to a separate, secured storage repository",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.3",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Write pipeline output artifacts to a secured storage repository.",
+          "RationaleStatement": "To maintain output artifacts securely and reduce the potential surface for attack, store such artifacts separately in secure storage. This separation enforces the Single Responsibility Principle by ensuring the orchestration platform will not be the same as the artifact storage, which reduces the potential harm of an attack. Using the same security considerations as the input (for example, the source code) will protect artifacts stored and will make it harder for a malicious actor to successfully execute an attack.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each pipeline that produces output artifacts, write them to a secured storage repository.",
+          "AuditProcedure": "For each pipeline that produces output artifacts, ensure that they're written to a secured storage repository.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.3.4",
+      "Description": "Ensure changes to pipeline files are tracked and reviewed",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.3",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Track and review changes to pipeline files.",
+          "RationaleStatement": "Pipeline files are sensitive files. They have the ability to access sensitive data and control the build process, thus it is just as important to review changes to pipeline files as it is to verify source code. Malicious actors can potentially add harmful code to these files, which may lead to sensitive data exposure and hijacking of the build environment or artifacts.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each pipeline file, track changes to it and review them.",
+          "AuditProcedure": "For each pipeline file, ensure changes to it are being tracked and reviewed.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.3.5",
+      "Description": "Ensure access to build process triggering is minimized",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.3",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Restrict access to pipeline triggers.",
+          "RationaleStatement": "Build pipelines are used for multiple reasons. Some are very sensitive, such as pipelines which deploy to production. In order to protect the environment from malicious acts or human mistakes, such as a developer deploying a bug to production, it is important to apply the Least Privilege principle to pipeline triggering. This principle requires restrictions placed on which users can run which pipeline. It allows for sensitive pipelines to only be run by administrators, who are generally the most trusted and skilled members of the organization.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For every pipeline in use, grant only the necessary users permission to trigger it.",
+          "AuditProcedure": "For every pipeline in use, verify only the necessary users have permission to trigger it.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.3.6",
+      "Description": "Ensure pipelines are automatically scanned for misconfigurations",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.3",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Scan the pipeline for misconfigurations. It is recommended that this be performed automatically.",
+          "RationaleStatement": "Automatic scans for misconfigurations detect human mistakes and misconfigured tasks. This protects the environment from backdoors caused by such mistakes, which create easier access for attackers. For example, a task that mistakenly configures credentials to persist on the disk makes it easier for an attacker to steal them. This type of incident can be prevented by auto-scanning.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each pipeline, set automated misconfiguration scanning.",
+          "AuditProcedure": "For each pipeline, verify that it is automatically scanned for misconfigurations.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.3.7",
+      "Description": "Ensure pipelines are automatically scanned for vulnerabilities",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.3",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Scan pipelines for vulnerabilities. It is recommended that this be implemented automatically.",
+          "RationaleStatement": "Automatic scanning for vulnerabilities detects known vulnerabilities in pipeline instructions and components, allowing faster patching in case one is found. These vulnerabilities can lead to a potentially massive breach if not handled as fast as possible, as attackers might also be aware of such vulnerabilities.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each pipeline, set automated vulnerability scanning.",
+          "AuditProcedure": "For each pipeline, verify that it is automatically scanned for vulnerabilities.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.3.8",
+      "Description": "Ensure scanners are in place to identify and prevent sensitive data in pipeline files",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.3",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Automated",
+          "Description": "Detect and prevent sensitive data, such as confidential ID numbers, passwords, etc., in pipelines.",
+          "RationaleStatement": "Sensitive data in pipeline configuration, such as cloud provider credentials or repository credentials, create vulnerabilities with which malicious actors could steal such information if they gain access to a pipeline. In order to mitigate this, set scanners that will identify and prevent the existence of sensitive data in the pipeline.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For every pipeline that is in use, set scanners that will identify and prevent sensitive data within it.",
+          "AuditProcedure": "For every pipeline that is in use, verify that scanners are set to identify and prevent the existence of sensitive data within it.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.4.1",
+      "Description": "Ensure all artifacts on all releases are signed",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.4",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Sign all artifacts in all releases with user or organization keys.",
+          "RationaleStatement": "Signing artifacts is used to validate both their integrity and security. Organizations signal that artifacts may be trusted and they themselves produced them by ensuring that every artifact is properly signed. The presence of this signature also makes potentially malicious activity far more difficult.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For every artifact in every release, verify that all are properly signed.",
+          "AuditProcedure": "Ensure every artifact in every release is signed.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.4.2",
+      "Description": "Ensure all external dependencies used in the build process are locked",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.4",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "External dependencies may be public packages needed in the pipeline, or perhaps the public image being used for the build worker. Lock these external dependencies in every build pipeline.",
+          "RationaleStatement": "External dependencies are sources of code that aren't under organizational control. They might be intentionally or unintentionally infected with malicious code or have known vulnerabilities, which could result in sensitive data exposure, data harvesting, or the erosion of trust in an organization. Locking each external dependency to a specific, safe version gives more control and less chance for risk.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For all external dependencies being used in pipelines, verify they are locked.",
+          "AuditProcedure": "Ensure every external dependency being used in pipelines is locked.",
+          "AdditionalInformation": "",
+          "References": "https://argon.io/blog/pipeline-composition-analysis-how-your-ci-pipeline-presents-new-opportunities-for-attackers/"
+        }
+      ]
+    },
+    {
+      "Id": "2.4.3",
+      "Description": "Ensure dependencies are validated before being used",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.4",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Validate every dependency of the pipeline before use.",
+          "RationaleStatement": "To ensure that a dependency used in a pipeline is trusted and has not been infected by malicious actor (for example, the codecov incident), validate dependencies before using them. This can be accomplished by comparing the checksum of the dependency to its checksum in a trusted source. If a difference arises, this is a sign that an unknown actor has interfered and may have added malevolent code. If this dependency is used, it will infect the environment, which could end in a massive breach and leave the organization exposed to data leaks, etc.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For every dependency used in every pipeline, validate each one.",
+          "AuditProcedure": "For every dependency used in every pipeline, ensure it has been validated.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.4.4",
+      "Description": "Ensure the build pipeline creates reproducible artifacts",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.4",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Verify that the build pipeline creates reproducible artifacts, meaning that an artifact of the build pipeline is the same in every run when given the same input.",
+          "RationaleStatement": "A reproducible build is a build that produces the same artifact when given the same input data. Ensuring that the build pipeline produces the same artifact when given the same input helps verify that no change has been made to the artifact. This action allows an organization to trust that its artifacts are built only from safe code that has been reviewed and tested and has not been tainted or changed abruptly.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Create build pipelines that produce the same artifact given the same input (for example, artifacts that do not rely on timestamps).",
+          "AuditProcedure": "Ensure that build pipelines create reproducible artifacts.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.4.5",
+      "Description": "Ensure pipeline steps produce a Software Bill of Materials (SBOM)",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.4",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "SBOM (Software Bill of Materials) is a file that specifies each component of software or a build process. Generate an SBOM after each run of a pipeline.",
+          "RationaleStatement": "Generating a Software Bill of Materials after each run of a pipeline will validate the integrity and security of that pipeline. Recording every step or component role in the pipeline ensures that no malicious acts have been committed during the pipeline's run.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each pipeline, configure it to produce a Software Bill of Materials on every run.",
+          "AuditProcedure": "For each pipeline, ensure it produces a Software Bill of Materials on every run.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "2.4.6",
+      "Description": "Ensure pipeline steps sign the Software Bill of Materials (SBOM) produced",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "2.4",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "SBOM (Software Bill of Materials) is a file that specifies each component of software or a build process. It should be generated after every pipeline run. After it is generated, it must then be signed.",
+          "RationaleStatement": "Software Bill of Materials (SBOM) is a file used to validate the integrity and security of a build pipeline. Signing it ensures that no one tampered with the file when it was delivered. Such interference can happen if someone tries to hide unusual activity. Validating the SBOM signature can detect this activity and prevent much greater incident.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each pipeline, configure it to sign its produced Software Bill of Materials on every run.",
+          "AuditProcedure": "For each pipeline, ensure it signs the Software Bill of Materials it produces on every run.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "3.1.1",
+      "Description": "Ensure third-party artifacts and open-source libraries are verified",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "3.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure third-party artifacts and open-source libraries in use are trusted and verified.",
+          "RationaleStatement": "Verify third-party artifacts used in code are trusted and have not been infected by a malicious actor before use. This can be accomplished, for example, by comparing the checksum of the dependency to its checksum in a trusted source. If a difference arises, this may be a sign that someone interfered and added malicious code. If this dependency is used, it will infect the environment and could end in a massive breach, leaving the organization exposed to data leaks and more.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Verify every GitHub action (building block of a GitHub workflow) in use by performing the following: \n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the left sidebar, click **Actions**, then click **General**.\n 4. Under \"Policies\", check **Allow OWNER, and select non-OWNER, actions and reusable workflows**, and then **Allow actions created by GitHub**.\n 5. Click **Save**.\n \n\n Alternatively, perform the following for each repository where GitHub actions are used:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the left sidebar, click **Actions**, then click **General**.\n 4. Under \"Actions permissions\", check **Allow OWNER, and select non-OWNER, actions and reusable workflows**, and then **Allow actions created by GitHub**.\n 5. Click **Save**.",
+          "AuditProcedure": "For every GitHub action (building block of a GitHub workflow), ensure verification before use by performing the following: \n \n\n 1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n 2. Next to the organization, click **Settings**.\n 3. In the left sidebar, click **Actions**, then click **General**.\n 4. Under \"Policies\", ensure **Allow OWNER, and select non-OWNER, actions and reusable workflows**, and **Allow actions created by GitHub** are checked.\n \n\n Alternatively, perform the following for each repository where GitHub actions are used:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the left sidebar, click **Actions**, then click **General**.\n 4. Under \"Actions permissions\", ensure **Allow OWNER, and select non-OWNER, actions and reusable workflows** and **Allow actions created by GitHub** are checked.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "3.1.2",
+      "Description": "Ensure Software Bill of Materials (SBOM) is required from all third-party suppliers",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "3.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "A Software Bill Of Materials (SBOM) is a file that specifies each component of software or a build process. Require an SBOM from every third-party provider.",
+          "RationaleStatement": "A Software Bill of Materials (SBOM) for every third-party artifact helps to ensure an artifact is safe to use and fully compliant. This file lists all important metadata, especially all the dependencies of an artifact, and allows for verification of each dependency. If one of the dependencies/artifacts are attacked or has a new vulnerability (for example, the \"SolarWinds\" or even \"log4j\" attacks), it is easier to detect what has been affected by this incident because dependencies in use are listed in the SBOM file.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For every third-party dependency in use, require a Software Bill of Materials from its supplier.",
+          "AuditProcedure": "For every third-party dependency in use, ensure it has a Software Bill of Materials.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "3.1.3",
+      "Description": "Ensure signed metadata of the build process is required and verified",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "3.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Require and verify signed metadata of the build process for all dependencies in use.",
+          "RationaleStatement": "The metadata of a build process lists every action that took place during an artifact build. It is used to ensure that an artifact has not been compromised during the build, that no malicious code was injected into it, and that no nefarious dependencies were added during the build phase. This creates trust between user and vendor that the software supplied is exactly the software that was promised. Signing this metadata adds a checksum to ensure there have been no revisions since its creation, as this checksum changes when the metadata is altered. Verification of proper metadata signature with Certificate Authority confirms that the signature was produced by a trusted entity.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each artifact in use, require and verify signed metadata of the build process.",
+          "AuditProcedure": "For each artifact used, ensure it was supplied with verified and signed metadata of its build process. The signature should be the organizational signature and should be verifiable by common Certificate Authority servers.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "3.1.4",
+      "Description": "Ensure dependencies are monitored between open-source components",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "3.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Monitor, or ask software suppliers to monitor, dependencies between open-source components in use.",
+          "RationaleStatement": "Monitoring dependencies between open-source components helps to detect if software has fallen victim to attack on a common open-source component. Swift detection can aid in quick application of a fix. It also helps find potential compliance problems with components usage. Some dependencies might not be compatible with the organization's policies, and other dependencies might have a license that is not compatible with how the organization uses this specific dependency. If dependencies are monitored, such situations can be detected and mitigated sooner, potentially deterring malicious attacks.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each open-source component, monitor its dependencies.",
+          "AuditProcedure": "For each open-source component, ensure its dependencies are monitored.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "3.1.5",
+      "Description": "Ensure trusted package managers and repositories are defined and prioritized",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "3.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Prioritize trusted package registries over others when pulling a package.",
+          "RationaleStatement": "When pulling a package by name, the package manager might look for it in several package registries, some of which may be untrusted or badly configured. If the package is pulled from such a registry, there is a higher likelihood that it could prove malicious. In order to avoid this, configure packages to be pulled from trusted package registries.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each package to be downloaded, configure it to be downloaded from a trusted source.",
+          "AuditProcedure": "For each package registry in use, ensure it is trusted.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "3.1.6",
+      "Description": "Ensure a signed Software Bill of Materials (SBOM) of the code is supplied",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "3.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "A Software Bill of Materials (SBOM) is a file that specifies each component of software or a build process. When using a dependency, demand its SBOM and ensure it is signed for validation purposes.",
+          "RationaleStatement": "A Software Bill of Materials (SBOM) creates trust between its provider and its users by ensuring that the software supplied is the software described, without any potential interference in between. Signing an SBOM creates a checksum for it, which will change if the SBOM's content was changed. With that checksum, a software user can be certain nothing had happened to it during the supply chain, engendering trust in the software. When there is no such trust in the software, the risk surface is increased because one cannot know if the software is potentially vulnerable. Demanding a signed SBOM and validating it decreases that risk.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For every artifact supplied, require and verify a signed Software Bill of Materials from its supplier.",
+          "AuditProcedure": "For every artifact supplied, ensure it has a validated, signed Software Bill of Materials.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "3.1.7",
+      "Description": "Ensure dependencies are pinned to a specific, verified version",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "3.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Pin dependencies to a specific version. Avoid using the \"latest\" tag or broad version.",
+          "RationaleStatement": "When using a wildcard version of a package, or the \"latest\" tag, the risk of encountering a new, potentially malicious package increases. The \"latest\" tag pulls the last package pushed to the registry. This means that if an attacker pushes a new, malicious package successfully to the registry, the next user who pulls the \"latest\" will pull it and risk attack. This same rule applies to a wildcard version - assuming one is using version v1.*, it will install the latest version of the major version 1, meaning that if an attacker can push a malicious package with that same version, those using it will be subject to possible attack. By using a secure, verified version, use is restricted to this version only and no other may be pulled, decreasing the risk for any malicious package.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For every dependency in use, pin to a specific version.",
+          "AuditProcedure": "For every dependency in use, ensure it is pinned to a specific version.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "3.1.8",
+      "Description": "Ensure all packages used are more than 60 days old",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "3.1",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Use packages that are more than 60 days old.",
+          "RationaleStatement": "Third-party packages are a major risk since an organization cannot control their source code, and there is always the possibility these packages could be malicious. It is therefore good practice to remain cautious with any third-party or open-source package, especially new ones, until they can be verified that they are safe to use. Avoiding a new package allows the organization to fully examine it, its maintainer, and its behavior, and gives enough time to determine whether or not to use it.",
+          "ImpactStatement": "Developers may not use packages that are less than 60 days old.",
+          "RemediationProcedure": "If a package used is less than 60 days old, stop using it and find another solution.",
+          "AuditProcedure": "For every package used, ensure it is more than 60 days old.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "",
+      "Description": "Validate Packages",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "3.2",
+          "Profile": "",
+          "AssessmentStatus": "",
+          "Description": "This section consists of security recommendations for managing package validations and checks. Third-party packages and dependencies might put the organization in danger, not only by being vulnerable to attacks, but also by being improperly used and harming license conditions. To protect the software supply chain from these dangers, it is important to validate packages and understand how and if to use them. This section's recommendations cover this topic.",
+          "RationaleStatement": "",
+          "ImpactStatement": "",
+          "RemediationProcedure": "",
+          "AuditProcedure": "",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "3.2.1",
+      "Description": "Ensure an organization-wide dependency usage policy is enforced",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "3.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Enforce a policy for dependency usage across the organization. For example, disallow the use of packages less than 60 days old.",
+          "RationaleStatement": "Enforcing a policy for dependency usage in an organization helps to manage dependencies across the organization and ensure that all usage is compliant with security policy. If, for example, the policy limits the package managers that can be used, enforcing it will make sure that every dependency is installed only from these package managers, and limit the risk of installing from any untrusted source.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Enforce policies for dependency usage across the organization.",
+          "AuditProcedure": "Verify that a policy for dependency usage is enforced across the organization.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "3.2.2",
+      "Description": "Ensure packages are automatically scanned for known vulnerabilities",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "3.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Automatically scan every package for vulnerabilities.",
+          "RationaleStatement": "Automatic scanning for vulnerabilities detects known vulnerabilities in packages and dependencies in use, allowing faster patching when one is found. Such vulnerabilities can lead to a massive breach if not handled as fast as possible, as attackers will also know about those vulnerabilities and swiftly try to take advantage of them. Scanning packages regularly for vulnerabilities can also verify usage compliance with the organization's security policy.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Set automatic scanning of packages for vulnerabilities.",
+          "AuditProcedure": "Ensure automatic scanning of packages for vulnerabilities is enabled.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "3.2.3",
+      "Description": "Ensure packages are automatically scanned for license implications",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "3.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "A software license is a document that provides legal conditions and guidelines for the use and distribution of software, usually defined by the author. It is recommended to scan for any legal implications automatically.",
+          "RationaleStatement": "When using packages with software licenses, especially commercial ones which tend to be the strictest, it is important to verify that the use of the package meets the conditions of the license. If the use of the package violates the licensing agreement, it exposes the organization to possible lawsuits. Scanning used packages for such license implications leads to faster detection and quicker fixes of such violations, and also reduces the risk for a lawsuit.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Set automatic package scanning for license implications.",
+          "AuditProcedure": "Ensure license implication rules are configured and are scanned automatically.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "3.2.4",
+      "Description": "Ensure packages are automatically scanned for ownership change",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "3.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Scan every package automatically for ownership change.",
+          "RationaleStatement": "A change in package ownership is not a regular action. In some cases it can lead to a massive problem (for example, the \"event-stream\" incident). Open-source contributors are not always trusted, since by its very nature everyone can contribute. This means malicious actors can become contributors as well. Package maintainers might transfer their ownership to someone they do not know if maintaining the package is too much for them, in some cases without the other user's knowledge. This has led to known security breaches in the past. It is best to be aware of such activity as soon as it happens and to carefully examine the situation before continuing using the package in order to determine its safety.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Set automatic scanning of packages for ownership change.",
+          "AuditProcedure": "Ensure automatic scanning of packages for ownership change is set.",
+          "AdditionalInformation": "",
+          "References": "https://blog.npmjs.org/post/182828408610/the-security-risks-of-changing-package-owners.html:https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident"
+        }
+      ]
+    },
+    {
+      "Id": "4.1.1",
+      "Description": "Ensure all artifacts are signed by the build pipeline itself",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "4.1",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Configure the build pipeline to sign every artifact it produces and verify that each artifact has the appropriate signature.",
+          "RationaleStatement": "A cryptographic signature can be used to verify artifact authenticity. The signature created with a certain key is unique and not reversible, thus making it unique to the author. This means that an attacker tampering with a signed artifact will be noticed immediately using a simple verification step because the signature will change. Signing artifacts by the build pipeline that produces them ensures the integrity of those artifacts.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Sign every artifact produced with the build pipeline that created it. Configure the build pipeline to sign each artifact.\n \n\n Steps from GitHub Documentation:\n \n\n You can follow the steps below to sign artifacts in GitHub actions. The trick involves loading in your private key into GitHub Actions using the gpg command-line commands.\n \n\n Export your gpg private key from the system that you have created it.\n Find your key-id (using gpg --list-secret-keys --keyid-format=long)\n Export the gpg secret key to an ASCII file using gpg --export-secret-keys -a  > secret.txt\n Edit secret.txt using a plain text editor, and replace all newlines with a literal \"\\n\" until everything is on a single line\n Set up GitHub Actions secrets\n Create a secret called OSSRH_GPG_SECRET_KEY using the text from your edited secret.txt file (the whole text should be in a single line)\n Create a secret called OSSRH_GPG_SECRET_KEY_PASSWORD containing the password for your gpg secret key\n Create a GitHub Actions step to install the gpg secret key\n Add an action similar to:\n ```\n - id: install-secret-key\n  name: Install gpg secret key\n  run: |\n  cat <(echo -e \"${{ secrets.OSSRH_GPG_SECRET_KEY }}\") | gpg --batch --import\n  gpg --list-secret-keys --keyid-format LONG\n ```\n Verify that the secret key is shown in the GitHub Actions logs\n You can remove the output from list secret keys if you are confident that this action will work, but it is better to leave it in there\n Bring it all together, and create a GitHub Actions step to publish\n Add an action similar to:\n ```\n - id: publish-to-central\n  name: Publish to Central Repository\n  env:\n  MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}\n  MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }}\n  run: |\n  mvn \\\n  --no-transfer-progress \\\n  --batch-mode \\\n  -Dgpg.passphrase=${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }} \\\n  clean deploy\n ```\n After a couple of hours, verify that the artifact got published to The Central Repository",
+          "AuditProcedure": "Verify that the build pipeline signs every new artifact it produces and all artifacts are signed.\n \n\n There are many different signing tools or options each have there own method or commands to verify that the code or package created is signed.",
+          "AdditionalInformation": "",
+          "References": "https://docs.github.com/en/code-security/supply-chain-security/end-to-end-supply-chain/securing-builds:https://gist.github.com/sualeh/ae78dc16123899d7942bc38baba5203c"
+        }
+      ]
+    },
+    {
+      "Id": "4.1.2",
+      "Description": "Ensure artifacts are encrypted before distribution",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "4.1",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Encrypt artifacts before they are distributed and ensure only trusted platforms have decryption capabilities.",
+          "RationaleStatement": "Build artifacts might contain sensitive data such as production configurations. In order to protect them and decrease the risk for breach, it is recommended to encrypt them before delivery. Encryption makes data unreadable, so even if attackers gain access to these artifacts, they won't be able to harvest sensitive data from them without the decryption key.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Encrypt every artifact before distribution.",
+          "AuditProcedure": "Ensure every artifact is encrypted before it is delivered.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.1.3",
+      "Description": "Ensure only authorized platforms have decryption capabilities of artifacts",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "4.1",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Grant decryption capabilities of artifacts only to trusted and authorized platforms.",
+          "RationaleStatement": "Build artifacts might contain sensitive data such as production configuration. To protect them and decrease the risk of a breach, it is recommended to encrypt them before delivery. This will make them unreadable for every unauthorized user who doesn't have the decryption key. By implementing this, the decryption capabilities become overly sensitive in order to prevent a data leak or theft. Ensuring that only trusted and authorized platforms can decrypt the organization's packages decreases the possibility for an attacker to gain access to the critical data in artifacts.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Grant decryption capabilities of the organization's artifacts only for trusted and authorized platforms.",
+          "AuditProcedure": "Ensure only trusted and authorized platforms have decryption capabilities of the organization's artifacts.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "",
+      "Description": "Access to Artifacts",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "4.2",
+          "Profile": "",
+          "AssessmentStatus": "",
+          "Description": "This section consists of security recommendations for access management of artifacts. \n \n\n Artifacts are often stored in registries, some external and some internal. Those registries have user entities that control access and permissions. Artifacts are considered sensitive, because they are being delivered to the costumer, and are prune to many attacks: data theft, dependency confusion, malicious packages and more. That's why their access management should be restrictive and careful.",
+          "RationaleStatement": "",
+          "ImpactStatement": "",
+          "RemediationProcedure": "",
+          "AuditProcedure": "",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.2.1",
+      "Description": "Ensure the authority to certify artifacts is limited",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "4.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Software certification is used to verify the safety of certain software usage and to establish trust between the supplier and the consumer. Any artifact can be certified. Limit the authority to certify different artifacts.",
+          "RationaleStatement": "Artifact certification is a powerful tool in establishing trust. Clients use a software certificate to verify that the artifact is safe to use according to their security policies. Because of this, certifying artifacts is considered sensitive. If an artifact is for debugging or internal use, or if it were compromised, the organization would not want certification. An attacker gaining access to both certificate authority and the artifact registry might also be able to certify its own artifact and cause a major breach. To prevent these issues, limit which artifacts can be certified by which platform so there will be minimal access to certification.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Limit which artifact can be certified by which authority.",
+          "AuditProcedure": "Ensure only certain artifacts can be certified by certain parties.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.2.2",
+      "Description": "Ensure number of permitted users who may upload new artifacts is minimized",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "4.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Minimize ability to upload artifacts to the lowest number of trusted users possible.",
+          "RationaleStatement": "Artifacts might contain sensitive data. Even the simplest mistake can also lead to trust issues with customers and harm the integrity of the product. To decrease these risks, allow only trusted and qualified users to upload new artifacts. Those users are less likely to make mistakes. Having the lowest number of such users possible will also decrease the risk of hacked user accounts, which could lead to a massive breach or artifact compromising.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Allow only trusted and qualified users to upload new artifacts and limit them in number.",
+          "AuditProcedure": "Ensure only trusted and qualified users can upload new artifacts, and that their number is the lowest possible.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.2.3",
+      "Description": "Ensure user access to the package registry utilizes Multi-Factor Authentication (MFA)",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "4.2",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Enforce Multi-Factor Authentication (MFA) for user access to the package registry.",
+          "RationaleStatement": "By default, every user authenticates to the system by password only. If a user's password is compromised, the user account and all its related packages are in danger of data theft and malicious builds. It is therefore recommended that each user enables Multi-Factor Authentication. This additional step guarantees that the account stays secure even if the user's password is compromised, as it adds another layer of authentication.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each package registry in use, enforce Multi-Factor Authentication as the only way to authenticate.",
+          "AuditProcedure": "For each package registry in use, verify that Multi-Factor Authentication is enforced and is the only way to authenticate.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.2.4",
+      "Description": "Ensure user management of the package registry is not local",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "4.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Manage users and their access to the package registry with an external authentication server and not with the package registry itself.",
+          "RationaleStatement": "Some package registries offer a tool for user management, aside from the main Lightweight Directory Access Protocol (LDAP) or Active Directory (AD) server of the organization. That tool usually offers simple authentication and role-based permissions, which might not be granular enough. Having multiple user management tools in the organization could result in confusion and privilege escalation, as there will be more to manage. To avoid a situation where users escalate their privileges because someone missed them, manage user access to the package registry via the main authentication server and not locally on the package registry.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each package registry, use the main authentication server of the organization for user management and do not manage locally.",
+          "AuditProcedure": "For each package registry, verify that its user access is not managed locally, but instead with the main authentication server of the organization.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.2.5",
+      "Description": "Ensure anonymous access to artifacts is revoked",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "4.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "For GitHub Private or Internal repositories anonymous access is not available. Verify that all repos that require access controls are Private or Internal.",
+          "RationaleStatement": "Disable the option to view artifacts as an anonymous user in order to protect private artifacts from being exposed.",
+          "ImpactStatement": "Only logged and authorized users will be able to access artifacts.",
+          "RemediationProcedure": "Changing a repository's visibility\n \n\n 1. On your GitHub Enterprise Server instance, navigate to the main page of the repository.\n 1. Under your repository name, click Settings\n 1. Under \"Danger Zone\", to the right of to \"Change repository visibility\", click Change visibility.\n 1. Select a visibility.\n \n\n 1. Choose \n  - Mark private\n  - Make Internal\n \n\n 6. To verify that you're changing the correct repository's visibility, type the name of the repository you want to change the visibility of.",
+          "AuditProcedure": "To Audit the existing settings:\n \n\n 1. On your GitHub Enterprise Server instance, navigate to the main page of the repository.\n 1. Under your repository name, click Settings\n 3. Under \"Danger Zone\", to the right of to \"Change repository visibility\", click Change visibility.\n \n\n Review the current selection.",
+          "AdditionalInformation": "",
+          "References": "https://docs.github.com/en/enterprise-server@3.3/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
+        }
+      ]
+    },
+    {
+      "Id": "4.2.6",
+      "Description": "Ensure minimum number of administrators are set for the package registry",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "4.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Ensure the package registry has a minimum number of administrators.",
+          "RationaleStatement": "Package registry admins have the ability to add/remove users, repositories, packages. Due to the permissive access granted to an admin, it is highly recommended to keep the number of administrator accounts as minimal as possible.",
+          "ImpactStatement": "Administrator privileges are required to provide and maintain a secure and stable platform but allowing extraneous administrator accounts can create a vulnerability.",
+          "RemediationProcedure": "Set the minimum number of administrators in your package registry.\n \n\n To accomplish this:\n \n\n For each repository that you administer on GitHub, you can see an overview of every team or person with access to the repository. From the overview, choose Manage access and provide access to the appropriate people or teams.",
+          "AuditProcedure": "Verify that your package registry has only the minimum number of administrators.\n \n\n For each repository that you administer on GitHub, you can see an overview of every team or person with access to the repository. From the overview, you can also invite new teams or people, change each team or person's role for the repository, or remove access to the repository.",
+          "AdditionalInformation": "",
+          "References": "https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/managing-teams-and-people-with-access-to-your-repository"
+        }
+      ]
+    },
+    {
+      "Id": "4.3.1",
+      "Description": "Ensure all signed artifacts are validated upon uploading the package registry",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "4.3",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Validate artifact signatures before uploading to the package registry.",
+          "RationaleStatement": "Cryptographic signature is a tool to verify artifact authenticity. Every artifact is supposed to be signed by its creator in order to confirm that it was not compromised before reaching the client. Validating an artifact signature before delivering it is another level of protection which ensures the signature has not been changed, meaning no one tried or succeeded in tampering with the artifact. This creates trust between the supplier and the client.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Validate every artifact with its signature before uploading it to the package registry. It is recommended to do so automatically.",
+          "AuditProcedure": "Ensure every artifact in the package registry has been validated with its signature.\n \n\n 1. On GitHub, navigate to a pull request\n 2. On the pull request, click <> Commits and view the detailed information regarding the signature.",
+          "AdditionalInformation": "",
+          "References": "https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification:https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits"
+        }
+      ]
+    },
+    {
+      "Id": "4.3.2",
+      "Description": "Ensure all versions of an existing artifact have their signatures validated",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "4.3",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Validate the signature of all versions of an existing artifact.",
+          "RationaleStatement": "In order to be certain a version of an existing and trusted artifact is not malicious or delivered by someone looking to interfere with the supply chain, it is a good practice to validate the signatures of each version. Doing so decreases the risk of using a compromised artifact, which might lead to a breach.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each artifact, sign and validate each version before uploading or using the artifact.",
+          "AuditProcedure": "For each artifact, ensure that all of its versions are signed and validated before it is uploaded or used.\n \n\n Ensure every artifact in the package registry has been validated with its signature.\n \n\n On GitHub, navigate to a pull request\n On the pull request, click <> Commits and view the detailed information regarding the signature.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.3.3",
+      "Description": "Ensure changes in package registry configuration are audited",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "4.3",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Audit changes of the package registry configuration.",
+          "RationaleStatement": "The package registry is a crucial component in the software supply chain. It stores artifacts with potentially sensitive data that will eventually be deployed and used in production. Every change made to the package registry configuration must be examined carefully to ensure no exposure of the registry's sensitive data. This examination also ensures no malicious actors have performed modifications to a stored artifact. Auditing the configuration and its changes helps in decreasing such risks.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Audit the changes to the package registry configuration.",
+          "AuditProcedure": "Verify that all changes to the packages registry configuration are audited.\n \n\n Search the audit log with\n \n\n repo category actions",
+          "AdditionalInformation": "",
+          "References": "https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization"
+        }
+      ]
+    },
+    {
+      "Id": "4.3.4",
+      "Description": "Ensure webhooks of the repository are secured",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "4.3",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Use secured webhooks to reduce the possibility of malicious payloads.",
+          "RationaleStatement": "Webhooks are used for triggering an HTTP request based on an action made in the platform. Typically, package registries feature webhooks when a package receives an update. Since webhooks are an HTTP POST request, they can be malformed if not secured over SSL. To prevent a potential hack and compromise of the webhook or to the registry or web server excepting the request, use only secured webhooks.",
+          "ImpactStatement": "Reduces the payloads that the web hook can listen for and recieve.",
+          "RemediationProcedure": "For each webhook in use, change it to secured (over HTTPS).",
+          "AuditProcedure": "",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "4.4.1",
+      "Description": "Ensure artifacts contain information about their origin",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "4.4",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "When delivering artifacts, ensure they have information about their origin. This may be done by providing a Software Bill of Manufacture (SBOM) or some metadata files.",
+          "RationaleStatement": "Information about artifact origin can be used for verification purposes. Having this kind of information allows the user to decide if the organization supplying the artifact is trusted. In a case of potential vulnerability or version update, this can be used to verify that the organization issuing it is the actual origin and not someone else. If users need to report problems with the artifact, they will have an address to contact as well.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each artifact supplied, supply information about its origin. For each artifact in use, ask for information about its origin.",
+          "AuditProcedure": "For each artifact, ensure it has information about its origin.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "5.1.1",
+      "Description": "Ensure deployment configuration files are separated from source code",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "5.1",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Deployment configurations are often stored in a version control system. Separate deployment configuration files from source code repositories.",
+          "RationaleStatement": "Deployment configuration manifests are often stored in version control systems. Storing them in dedicated repositories, separately from source code repositories, has several benefits. First, it adds order to both maintenance and version control history. This makes it easier to track code or manifest changes, as well as spot any malicious code or misconfigurations. Second, it helps achieve the Least Privilege principle. Because access can be configured differently for each repository, fewer users will have access to this configuration, which is typically sensitive.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Store each deployment configuration file in a dedicated repository separately from source code.",
+          "AuditProcedure": "Ensure each deployment configuration file is stored separately from source code.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "5.1.2",
+      "Description": "Ensure changes in deployment configuration are audited",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "5.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Audit and track changes made in deployment configuration.",
+          "RationaleStatement": "Deployment configuration is sensitive in nature. The tiniest mistake can lead to downtime or bugs in production, which consequently may have a direct effect on both product integrity and customer trust. Misconfigurations might also be used by malicious actors to attack the production platform. Because of this, every change in the configuration needs a review and possible \"revert\" in case of a mistake or malicious change. Auditing every change and tracking them helps detect and fix such incidents more quickly.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each deployment configuration, track and audit changes made to it.",
+          "AuditProcedure": "For each deployment configuration, ensure changes made to it are audited and tracked.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "5.1.3",
+      "Description": "Ensure scanners are in place to identify and prevent sensitive data in deployment configuration",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "5.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Detect and prevent sensitive data – such as confidential ID numbers, passwords, etc. – in deployment configurations.",
+          "RationaleStatement": "Sensitive data in deployment configurations might create a major incident if an attacker gains access to it, as this can cause data loss and theft. It is important to keep sensitive data safe and to not expose it in the configuration. In order to prevent a possible exposure, set scanners that will identify and prevent such data in deployment configurations.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each deployment configuration file, set scanners to identify and prevent sensitive data within it.",
+          "AuditProcedure": "For each deployment configuration file, verify that scanners are set to identify and prevent the existence of sensitive data within it.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "5.1.4",
+      "Description": "Limit access to deployment configurations",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "5.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Restrict access to the deployment configuration to trusted and qualified users only.",
+          "RationaleStatement": "Deployment configurations are sensitive in nature. The tiniest mistake can lead to downtime or bugs in production, which can have a direct effect on the product's integrity and customer trust. Misconfigurations might also be used by malicious actors to attack the production platform. To avoid such harm as much as possible, ensure only trusted and qualified users have access to such configurations. This will also reduce the number of accounts that might affect the environment in case of an attack.",
+          "ImpactStatement": "Reducing the number of users who have access to the deployment configuration means those users would lose their ability to make direct changes to that configuration.",
+          "RemediationProcedure": "Restrict access to the deployment configuration to trusted and qualified users.",
+          "AuditProcedure": "Verify each deployment configuration is accessible only to known and authorized users.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "5.1.5",
+      "Description": "Scan Infrastructure as Code (IaC)",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "5.1",
+          "Profile": "Level 2",
+          "AssessmentStatus": "Manual",
+          "Description": "Detect and prevent misconfigurations or insecure instructions in Infrastructure as Code (IaC) files, such as Terraform files.",
+          "RationaleStatement": "Infrastructure as Code (IaC) files are used for production environment and application deployment. These are sensitive parts of the software supply chain because they are always in touch with customers, and thus might affect their opinion of or trust in the product. Attackers often target these environments. Detecting and fixing misconfigurations and/or insecure instructions in IaC files decreases the risk for data leak or data theft. It is important to secure IaC instructions in order to prevent further problems of deployment, exposed assets, or improper configurations, which might ultimately lead to easier ways to attack and steal organization data.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For every Infrastructure as Code (IaC) instructions file, set scanners to identify and prevent misconfigurations and insecure instructions.",
+          "AuditProcedure": "For every Infrastructure as Code (IaC) instructions file, verify that scanners are set to identify and prevent misconfigurations and insecure instructions.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "5.1.6",
+      "Description": "Ensure deployment configuration manifests are verified",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "5.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Verify the deployment configuration manifests.",
+          "RationaleStatement": "To ensure that the configuration manifests used are trusted and have not been infected by malicious actors before arriving at the platform, it is important to verify the manifests. This may be done by comparing the checksum of the manifest file to its checksum in a trusted source. If a difference arises, this is a sign that an unknown actor has interfered and may have added malicious instructions. If this manifest is used, it might harm the environment and application deployment, which could end in a massive breach and leave the organization exposed to data leaks, etc.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Verify each deployment configuration manifest in use.",
+          "AuditProcedure": "For each deployment configuration manifest in use, ensure it has been verified.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "5.1.7",
+      "Description": "Ensure deployment configuration manifests are pinned to a specific, verified version",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "5.1",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Deployment configuration is often stored in a version control system and is pulled from there. Pin the configuration used to a specific, verified version or commit Secure Hash Algorithm (SHA). Avoid referring configuration without its version tag specified.",
+          "RationaleStatement": "Deployment configuration manifests are often stored in version control systems and pulled from there either by automation platforms, for example Ansible, or GitOps platforms, such as ArgoCD. When a manifest is pulled from a version control system without tag or commit Secure Hash Algorithm (SHA) specified, it is pulled from the HEAD revision, which is equal to the 'latest' tag, and pulls the last change made. This increases the risk of encountering a new, potentially malicious configuration. If an attacker pushes malicious configuration to the version control system, the next user who pulls the HEAD revision will pull it and risk attack. To avoid that risk, use a version tag of verified version or a commit SHA of a trusted commit, which will ensure this is the only version pulled.",
+          "ImpactStatement": "Changes in deployment configuration will not be pulled unless their version tag or commit Secure Hash Algorithm (SHA) is specified. This might slow down the deployment process.",
+          "RemediationProcedure": "For every deployment configuration manifest in use, pin to a specific version or commit Secure Hash Algorithm (SHA).",
+          "AuditProcedure": "For every deployment configuration manifest in use, ensure it is pinned to a specific version or commit Secure Hash Algorithm (SHA).",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "5.2.1",
+      "Description": "Ensure deployments are automated",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "5.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Automate deployments of production environment and application.",
+          "RationaleStatement": "Automating the deployments of both production environment and applications reduces the risk for human mistakes — such as a wrong configuration or exposure of sensitive data — because it requires less human interaction or intervention. It also eases redeployment of the environment. It is best to automate with Infrastructure as Code (IaC) because it offers more control over changes made to the environment creation configuration and stores to a version control platform.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Automate each deployment process of the production environment and application.",
+          "AuditProcedure": "For each deployment process, ensure it is automated.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "5.2.2",
+      "Description": "Ensure the deployment environment is reproducible",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "5.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Verify that the deployment environment – the orchestrator and the production environment where the application is deployed – is reproducible. This means that the environment stays the same in each deployment if the configuration has not changed.",
+          "RationaleStatement": "A reproducible build is a build that produces the same artifact when given the same input data, and in this case the same environment. Ensuring that the same environment is produced when given the same input helps verify that no change has been made to it. This action allows an organization to trust that its deployment environment is built only from safe code and configuration that has been reviewed and tested and has not been tainted or changed abruptly.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "Adjust the process that deploys the deployment/production environment to build the same environment each time when the configuration has not changed.",
+          "AuditProcedure": "Verify that the deployment/production environment is reproducible.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "5.2.3",
+      "Description": "Ensure access to production environment is limited",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "5.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Restrict access to the production environment to a few trusted and qualified users only.",
+          "RationaleStatement": "The production environment is an extremely sensitive one. It directly affects the customer experience and trust in a product, which has serious effects on the organization itself. Because of this sensitive nature, it is important to restrict access to the production environment to only a few trusted and qualified users. This will reduce the risk of mistakes such as exposure of secrets or misconfiguration. This restriction also reduces the number of accounts that are vulnerable to hijacking in order to potentially harm the production environment.",
+          "ImpactStatement": "Reducing the number of users who have access to the production environment means those users would lose their ability to make direct changes to that environment.",
+          "RemediationProcedure": "Restrict access to the production environment to trusted and qualified users.",
+          "AuditProcedure": "Verify that the production environment is accessible only to trusted and qualified users.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    },
+    {
+      "Id": "5.2.4",
+      "Description": "Ensure default passwords are not used",
+      "Checks": [
+        ""
+      ],
+      "Attributes": [
+        {
+          "Section": "5.2",
+          "Profile": "Level 1",
+          "AssessmentStatus": "Manual",
+          "Description": "Do not use default passwords of deployment tools and components.",
+          "RationaleStatement": "Many deployment tools and components are provided with default passwords for the first login. This password is intended to be used only on the first login and should be changed immediately after. Using the default password substantially increases the attack risk. It is very important to ensure that default passwords are not used in deployment tools and components.",
+          "ImpactStatement": "",
+          "RemediationProcedure": "For each deployment tool, change the password.",
+          "AuditProcedure": "For each deployment tool, ensure the password is not the default one.",
+          "AdditionalInformation": "",
+          "References": ""
+        }
+      ]
+    }
+  ]
 }
diff --git a/prowler/compliance/kubernetes/cis_1.10_kubernetes.json b/prowler/compliance/kubernetes/cis_1.10_kubernetes.json
index 7c7c9e6898..379504a127 100644
--- a/prowler/compliance/kubernetes/cis_1.10_kubernetes.json
+++ b/prowler/compliance/kubernetes/cis_1.10_kubernetes.json
@@ -10,8 +10,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the API server pod specification file has permissions of `600` or more restrictive.",
@@ -31,8 +31,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the API server pod specification file ownership is set to `root:root`.",
@@ -52,8 +52,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the controller manager pod specification file has permissions of `600` or more restrictive.",
@@ -73,8 +73,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the controller manager pod specification file ownership is set to `root:root`.",
@@ -94,8 +94,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the scheduler pod specification file has permissions of `600` or more restrictive.",
@@ -115,8 +115,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the scheduler pod specification file ownership is set to `root:root`.",
@@ -136,8 +136,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the `/etc/kubernetes/manifests/etcd.yaml` file has permissions of `600` or more restrictive.",
@@ -157,8 +157,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the `/etc/kubernetes/manifests/etcd.yaml` file ownership is set to `root:root`.",
@@ -178,8 +178,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Ensure that the Container Network Interface files have permissions of `600` or more restrictive.",
@@ -199,8 +199,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Ensure that the Container Network Interface files have ownership set to `root:root`.",
@@ -220,8 +220,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the etcd data directory has permissions of `700` or more restrictive.",
@@ -241,8 +241,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the etcd data directory ownership is set to `etcd:etcd`.",
@@ -262,8 +262,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the `admin.conf` file (and `super-admin.conf` file, where it exists) have permissions of `600`.",
@@ -283,8 +283,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the `admin.conf` (and `super-admin.conf` file, where it exists) file ownership is set to `root:root`.",
@@ -304,8 +304,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the `scheduler.conf` file has permissions of `600` or more restrictive.",
@@ -325,8 +325,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the `scheduler.conf` file ownership is set to `root:root`.",
@@ -346,8 +346,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the `controller-manager.conf` file has permissions of 600 or more restrictive.",
@@ -367,8 +367,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the `controller-manager.conf` file ownership is set to `root:root`.",
@@ -388,8 +388,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the Kubernetes PKI directory and file ownership is set to `root:root`.",
@@ -409,8 +409,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Ensure that Kubernetes PKI certificate files have permissions of `600` or more restrictive.",
@@ -430,8 +430,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.1. Control Plane Node Configuration Files",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Ensure that Kubernetes PKI key files have permissions of `600`.",
@@ -453,8 +453,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Disable anonymous requests to the API server.",
@@ -476,8 +476,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Do not use token based authentication.",
@@ -499,8 +499,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "This admission controller rejects all net-new usage of the Service field externalIPs.",
@@ -522,8 +522,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Enable certificate based kubelet authentication.",
@@ -545,8 +545,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Verify kubelet's certificate before establishing connection.",
@@ -568,8 +568,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Do not always authorize all requests.",
@@ -591,8 +591,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Restrict kubelet nodes to reading only objects associated with them.",
@@ -614,8 +614,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Turn on Role Based Access Control.",
@@ -637,8 +637,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Limit the rate at which the API server accepts requests.",
@@ -660,8 +660,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Do not allow all requests.",
@@ -683,8 +683,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Always pull images.",
@@ -706,8 +706,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Automate service accounts management.",
@@ -729,8 +729,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Reject creating objects in a namespace that is undergoing termination.",
@@ -752,8 +752,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Limit the `Node` and `Pod` objects that a kubelet could modify.",
@@ -775,8 +775,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Disable profiling, if not needed.",
@@ -798,8 +798,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Enable auditing on the Kubernetes API Server and set the desired audit log path.",
@@ -821,8 +821,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Retain the logs for at least 30 days or as appropriate.",
@@ -844,8 +844,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Retain 10 or an appropriate number of old log files.",
@@ -867,8 +867,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Rotate log files on reaching 100 MB or as appropriate.",
@@ -890,8 +890,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Set global request timeout for API server requests as appropriate.",
@@ -913,8 +913,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Validate service account before validating token.",
@@ -936,8 +936,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Explicitly set a service account public key file for service accounts on the apiserver.",
@@ -959,8 +959,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "etcd should be configured to make use of TLS encryption for client connections.",
@@ -982,8 +982,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Setup TLS connection on the API server.",
@@ -1005,8 +1005,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Setup TLS connection on the API server.",
@@ -1028,8 +1028,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "etcd should be configured to make use of TLS encryption for client connections.",
@@ -1051,8 +1051,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Encrypt etcd key-value store.",
@@ -1072,8 +1072,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Where `etcd` encryption is used, appropriate providers should be configured.",
@@ -1095,8 +1095,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.2. API Server",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Ensure that the API server is configured to only use strong cryptographic ciphers.",
@@ -1118,8 +1118,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.3. Controller Manager",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.3 Controller Manager",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Activate garbage collector on pod termination, as appropriate.",
@@ -1141,8 +1141,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.3. Controller Manager",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.3 Controller Manager",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Disable profiling, if not needed.",
@@ -1164,8 +1164,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.3. Controller Manager",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.3 Controller Manager",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Use individual service account credentials for each controller.",
@@ -1187,8 +1187,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.3. Controller Manager",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.3 Controller Manager",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Explicitly set a service account private key file for service accounts on the controller manager.",
@@ -1210,8 +1210,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.3. Controller Manager",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.3 Controller Manager",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Allow pods to verify the API server's serving certificate before establishing connections.",
@@ -1233,8 +1233,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.3. Controller Manager",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.3 Controller Manager",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Enable kubelet server certificate rotation on controller-manager.",
@@ -1256,8 +1256,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.3. Controller Manager",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.3 Controller Manager",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Do not bind the Controller Manager service to non-loopback insecure addresses.",
@@ -1279,8 +1279,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.4. Scheduler",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.4 Scheduler",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Disable profiling, if not needed.",
@@ -1302,8 +1302,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
-          "SubSection": "1.4. Scheduler",
+          "Section": "1 Control Plane Components",
+          "SubSection": "1.4 Scheduler",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Do not bind the scheduler service to non-loopback insecure addresses.",
@@ -1325,7 +1325,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. etcd",
+          "Section": "2 etcd",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Configure TLS encryption for the etcd service.",
@@ -1347,7 +1347,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. etcd",
+          "Section": "2 etcd",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Enable client authentication on etcd service.",
@@ -1369,7 +1369,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. etcd",
+          "Section": "2 etcd",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Do not use self-signed certificates for TLS.",
@@ -1391,7 +1391,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. etcd",
+          "Section": "2 etcd",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "etcd should be configured to make use of TLS encryption for peer connections.",
@@ -1413,7 +1413,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. etcd",
+          "Section": "2 etcd",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "etcd should be configured for peer authentication.",
@@ -1435,7 +1435,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. etcd",
+          "Section": "2 etcd",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Do not use automatically generated self-signed certificates for TLS connections between peers.",
@@ -1457,7 +1457,7 @@
       ],
       "Attributes": [
         {
-          "Section": "2. etcd",
+          "Section": "2 etcd",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Use a different certificate authority for etcd from the one used for Kubernetes.",
@@ -1477,8 +1477,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Control Plane Configuration",
-          "SubSection": "3.1. Authentication and Authorization",
+          "Section": "3 Control Plane Configuration",
+          "SubSection": "3.1 Authentication and Authorization",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Kubernetes provides the option to use client certificates for user authentication. However as there is no way to revoke these certificates when a user leaves an organization or loses their credential, they are not suitable for this purpose.It is not possible to fully disable client certificate use within a cluster as it is used for component to component authentication.",
@@ -1498,8 +1498,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Control Plane Configuration",
-          "SubSection": "3.1. Authentication and Authorization",
+          "Section": "3 Control Plane Configuration",
+          "SubSection": "3.1 Authentication and Authorization",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Kubernetes provides service account tokens which are intended for use by workloads running in the Kubernetes cluster, for authentication to the API server.These tokens are not designed for use by end-users and do not provide for features such as revocation or expiry, making them insecure. A newer version of the feature (Bound service account token volumes) does introduce expiry but still does not allow for specific revocation.",
@@ -1519,8 +1519,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Control Plane Configuration",
-          "SubSection": "3.1. Authentication and Authorization",
+          "Section": "3 Control Plane Configuration",
+          "SubSection": "3.1 Authentication and Authorization",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Kubernetes provides bootstrap tokens which are intended for use by new nodes joining the clusterThese tokens are not designed for use by end-users they are specifically designed for the purpose of bootstrapping new nodes and not for general authentication",
@@ -1540,8 +1540,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Control Plane Configuration",
-          "SubSection": "3.2. Logging",
+          "Section": "3 Control Plane Configuration",
+          "SubSection": "3.2 Logging",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Kubernetes can audit the details of requests made to the API server. The `--audit-policy-file` flag must be set for this logging to be enabled.",
@@ -1561,8 +1561,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Control Plane Configuration",
-          "SubSection": "3.2. Logging",
+          "Section": "3 Control Plane Configuration",
+          "SubSection": "3.2 Logging",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Ensure that the audit policy created for the cluster covers key security concerns.",
@@ -1584,8 +1584,8 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.1. Worker Node Configuration Files",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.1 Worker Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the `kubelet` service file has permissions of `600` or more restrictive.",
@@ -1607,8 +1607,8 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.1. Worker Node Configuration Files",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.1 Worker Node Configuration Files",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the `kubelet` service file ownership is set to `root:root`.",
@@ -1628,8 +1628,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.1. Worker Node Configuration Files",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.1 Worker Node Configuration Files",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
           "Description": "If `kube-proxy` is running, and if it is using a file-based kubeconfig file, ensure that the proxy kubeconfig file has permissions of `600` or more restrictive.",
@@ -1649,8 +1649,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.1. Worker Node Configuration Files",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.1 Worker Node Configuration Files",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
           "Description": "If `kube-proxy` is running, ensure that the file ownership of its kubeconfig file is set to `root:root`.",
@@ -1672,8 +1672,8 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.1. Worker Node Configuration Files",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.1 Worker Node Configuration Files",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the `kubelet.conf` file has permissions of `600` or more restrictive.",
@@ -1695,8 +1695,8 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.1. Worker Node Configuration Files",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.1 Worker Node Configuration Files",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that the `kubelet.conf` file ownership is set to `root:root`.",
@@ -1716,8 +1716,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.1. Worker Node Configuration Files",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.1 Worker Node Configuration Files",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
           "Description": "Ensure that the certificate authorities file has permissions of `600` or more restrictive.",
@@ -1737,8 +1737,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.1. Worker Node Configuration Files",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.1 Worker Node Configuration Files",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
           "Description": "Ensure that the certificate authorities file ownership is set to `root:root`.",
@@ -1760,8 +1760,8 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.1. Worker Node Configuration Files",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.1 Worker Node Configuration Files",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that if the kubelet refers to a configuration file with the `--config` argument, that file has permissions of 600 or more restrictive.",
@@ -1783,8 +1783,8 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.1. Worker Node Configuration Files",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.1 Worker Node Configuration Files",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
           "Description": "Ensure that if the kubelet refers to a configuration file with the `--config` argument, that file is owned by root:root.",
@@ -1806,8 +1806,8 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.2. Kubelet",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
           "Description": "Disable anonymous requests to the Kubelet server.",
@@ -1829,8 +1829,8 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.2. Kubelet",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
           "Description": "Do not allow all requests. Enable explicit authorization.",
@@ -1852,8 +1852,8 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.2. Kubelet",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
           "Description": "Enable Kubelet authentication using certificates.",
@@ -1875,8 +1875,8 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.2. Kubelet",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
           "Description": "Disable the read-only port.",
@@ -1898,8 +1898,8 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.2. Kubelet",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
           "Description": "Do not disable timeouts on streaming connections.",
@@ -1921,8 +1921,8 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.2. Kubelet",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
           "Description": "Allow Kubelet to manage iptables.",
@@ -1942,8 +1942,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.2. Kubelet",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
           "Description": "Do not override node hostnames.",
@@ -1965,8 +1965,8 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.2. Kubelet",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.2 Kubelet",
           "Profile": "Level 2 - Worker Node",
           "AssessmentStatus": "Manual",
           "Description": "Security relevant information should be captured. The eventRecordQPS on the Kubelet configuration can be used to limit the rate at which events are gathered and sets the maximum event creations per second. Setting this too low could result in relevant events not being logged, however the unlimited setting of `0` could result in a denial of service on the kubelet.",
@@ -1988,8 +1988,8 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.2. Kubelet",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
           "Description": "Setup TLS connection on the Kubelets.",
@@ -2011,8 +2011,8 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.2. Kubelet",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
           "Description": "Enable kubelet client certificate rotation.",
@@ -2032,8 +2032,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.2. Kubelet",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
           "Description": "Enable kubelet server certificate rotation.",
@@ -2055,8 +2055,8 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.2. Kubelet",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
           "Description": "Ensure that the Kubelet is configured to only use strong cryptographic ciphers.",
@@ -2076,8 +2076,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.2. Kubelet",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
           "Description": "Ensure that the Kubelet sets limits on the number of PIDs that can be created by pods running on the node.",
@@ -2097,8 +2097,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
-          "SubSection": "4.3. kube-proxy",
+          "Section": "4 Worker Nodes",
+          "SubSection": "4.3 kube-proxy",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
           "Description": "Do not bind the kube-proxy metrics port to non-loopback addresses.",
@@ -2120,8 +2120,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.1. RBAC and Service Accounts",
+          "Section": "5 Policies",
+          "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "The RBAC role `cluster-admin` provides wide-ranging powers over the environment and should be used only where and when needed.",
@@ -2143,8 +2143,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.1. RBAC and Service Accounts",
+          "Section": "5 Policies",
+          "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "The Kubernetes API stores secrets, which may be service account tokens for the Kubernetes API or credentials used by workloads in the cluster. Access to these secrets should be restricted to the smallest possible group of users to reduce the risk of privilege escalation.",
@@ -2166,8 +2166,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.1. RBAC and Service Accounts",
+          "Section": "5 Policies",
+          "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
           "Description": "Kubernetes Roles and ClusterRoles provide access to resources based on sets of objects and actions that can be taken on those objects. It is possible to set either of these to be the wildcard \"*\" which matches all items. Use of wildcards is not optimal from a security perspective as it may allow for inadvertent access to be granted when new resources are added to the Kubernetes API either as CRDs or in later versions of the product.",
@@ -2189,8 +2189,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.1. RBAC and Service Accounts",
+          "Section": "5 Policies",
+          "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "The ability to create pods in a namespace can provide a number of opportunities for privilege escalation, such as assigning privileged service accounts to these pods or mounting hostPaths with access to sensitive data (unless Pod Security Policies are implemented to restrict this access)As such, access to create new pods should be restricted to the smallest possible group of users.",
@@ -2210,8 +2210,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.1. RBAC and Service Accounts",
+          "Section": "5 Policies",
+          "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "The `default` service account should not be used to ensure that rights granted to applications can be more easily audited and reviewed.",
@@ -2231,8 +2231,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.1. RBAC and Service Accounts",
+          "Section": "5 Policies",
+          "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
           "Description": "Service accounts tokens should not be mounted in pods except where the workload running in the pod explicitly needs to communicate with the API server",
@@ -2252,8 +2252,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.1. RBAC and Service Accounts",
+          "Section": "5 Policies",
+          "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "The special group `system:masters` should not be used to grant permissions to any user or service account, except where strictly necessary (e.g. bootstrapping access prior to RBAC being fully available)",
@@ -2273,8 +2273,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.1. RBAC and Service Accounts",
+          "Section": "5 Policies",
+          "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Cluster roles and roles with the impersonate, bind or escalate permissions should not be granted unless strictly required. Each of these permissions allow a particular subject to escalate their privileges beyond those explicitly granted by cluster administrators",
@@ -2296,8 +2296,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.1. RBAC and Service Accounts",
+          "Section": "5 Policies",
+          "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "The ability to create persistent volumes in a cluster can provide an opportunity for privilege escalation, via the creation of `hostPath` volumes. As persistent volumes are not covered by Pod Security Admission, a user with access to create persistent volumes may be able to get access to sensitive files from the underlying host even where restrictive Pod Security Admission policies are in place.",
@@ -2319,8 +2319,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.1. RBAC and Service Accounts",
+          "Section": "5 Policies",
+          "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Users with access to the `Proxy` sub-resource of `Node` objects automatically have permissions to use the Kubelet API, which may allow for privilege escalation or bypass cluster security controls such as audit logs.The Kubelet provides an API which includes rights to execute commands in any container running on the node. Access to this API is covered by permissions to the main Kubernetes API via the `node` object. The proxy sub-resource specifically allows wide ranging access to the Kubelet API.Direct access to the Kubelet API bypasses controls like audit logging (there is no audit log of Kubelet API access) and admission control.",
@@ -2342,8 +2342,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.1. RBAC and Service Accounts",
+          "Section": "5 Policies",
+          "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Users with access to the update the `approval` sub-resource of `certificateaigningrequests` objects can approve new client certificates for the Kubernetes API effectively allowing them to create new high-privileged user accounts.This can allow for privilege escalation to full cluster administrator, depending on users configured in the cluster",
@@ -2365,8 +2365,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.1. RBAC and Service Accounts",
+          "Section": "5 Policies",
+          "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Users with rights to create/modify/delete `validatingwebhookconfigurations` or `mutatingwebhookconfigurations` can control webhooks that can read any object admitted to the cluster, and in the case of mutating webhooks, also mutate admitted objects. This could allow for privilege escalation or disruption of the operation of the cluster.",
@@ -2388,8 +2388,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.1. RBAC and Service Accounts",
+          "Section": "5 Policies",
+          "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Users with rights to create new service account tokens at a cluster level, can create long-lived privileged credentials in the cluster. This could allow for privilege escalation and persistent access to the cluster, even if the users account has been revoked.",
@@ -2409,8 +2409,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place",
+          "Section": "5 Policies",
+          "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Every Kubernetes cluster should have at least one policy control mechanism in place to enforce the other requirements in this section. This could be the in-built Pod Security Admission controller, or a third party policy control system.",
@@ -2432,8 +2432,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place",
+          "Section": "5 Policies",
+          "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Do not generally permit containers to be run with the `securityContext.privileged` flag set to `true`.",
@@ -2455,8 +2455,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place",
+          "Section": "5 Policies",
+          "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Do not generally permit containers to be run with the `hostPID` flag set to true.",
@@ -2478,8 +2478,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place",
+          "Section": "5 Policies",
+          "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Do not generally permit containers to be run with the `hostIPC` flag set to true.",
@@ -2501,8 +2501,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place",
+          "Section": "5 Policies",
+          "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Do not generally permit containers to be run with the `hostNetwork` flag set to true.",
@@ -2524,8 +2524,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place",
+          "Section": "5 Policies",
+          "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Do not generally permit containers to be run with the `allowPrivilegeEscalation` flag set to true. Allowing this right can lead to a process running a container getting more rights than it started with.It's important to note that these rights are still constrained by the overall container sandbox, and this setting does not relate to the use of privileged containers.",
@@ -2547,8 +2547,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place",
+          "Section": "5 Policies",
+          "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Do not generally permit containers to be run as the root user.",
@@ -2570,8 +2570,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place",
+          "Section": "5 Policies",
+          "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Do not generally permit containers with the potentially dangerous NET_RAW capability.",
@@ -2593,8 +2593,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place",
+          "Section": "5 Policies",
+          "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Do not generally permit containers with capabilities assigned beyond the default set.",
@@ -2616,8 +2616,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place",
+          "Section": "5 Policies",
+          "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Do not generally permit containers with capabilities",
@@ -2639,8 +2639,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place",
+          "Section": "5 Policies",
+          "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Do not generally permit Windows containers to be run with the `hostProcess` flag set to true.",
@@ -2660,8 +2660,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place",
+          "Section": "5 Policies",
+          "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Do not generally admit containers which make use of `hostPath` volumes.",
@@ -2683,8 +2683,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place",
+          "Section": "5 Policies",
+          "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Do not generally permit containers which require the use of HostPorts.",
@@ -2704,8 +2704,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.3. Network Policies and CNI",
+          "Section": "5 Policies",
+          "SubSection": "5.3 Network Policies and CNI",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "There are a variety of CNI plugins available for Kubernetes. If the CNI in use does not support Network Policies it may not be possible to effectively restrict traffic in the cluster.",
@@ -2725,8 +2725,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.3. Network Policies and CNI",
+          "Section": "5 Policies",
+          "SubSection": "5.3 Network Policies and CNI",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Use network policies to isolate traffic in your cluster network.",
@@ -2748,8 +2748,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.4. Secrets Management",
+          "Section": "5 Policies",
+          "SubSection": "5.4 Secrets Management",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Kubernetes supports mounting secrets as data volumes or as environment variables. Minimize the use of environment variable secrets.",
@@ -2769,8 +2769,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.4. Secrets Management",
+          "Section": "5 Policies",
+          "SubSection": "5.4 Secrets Management",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Consider the use of an external secrets storage and management system, instead of using Kubernetes Secrets directly, if you have more complex secret management needs. Ensure the solution requires authentication to access secrets, has auditing of access to and use of secrets, and encrypts secrets. Some solutions also make it easier to rotate secrets.",
@@ -2790,8 +2790,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.5. Extensible Admission Control",
+          "Section": "5 Policies",
+          "SubSection": "5.5 Extensible Admission Control",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Configure Image Provenance for your deployment.",
@@ -2811,8 +2811,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.7. General Policies",
+          "Section": "5 Policies",
+          "SubSection": "5.7 General Policies",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Use namespaces to isolate your Kubernetes objects.",
@@ -2834,8 +2834,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.7. General Policies",
+          "Section": "5 Policies",
+          "SubSection": "5.7 General Policies",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Enable `docker/default` seccomp profile in your pod definitions.",
@@ -2855,8 +2855,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.7. General Policies",
+          "Section": "5 Policies",
+          "SubSection": "5.7 General Policies",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Apply Security Context to Your Pods and Containers",
@@ -2876,8 +2876,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
-          "SubSection": "5.7. General Policies",
+          "Section": "5 Policies",
+          "SubSection": "5.7 General Policies",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
           "Description": "Kubernetes provides a default namespace, where objects are placed if no namespace is specified for them. Placing objects in this namespace makes application of RBAC and other controls more difficult.",
diff --git a/prowler/compliance/kubernetes/cis_1.8_kubernetes.json b/prowler/compliance/kubernetes/cis_1.8_kubernetes.json
index d5786b6668..88fcfd59b2 100644
--- a/prowler/compliance/kubernetes/cis_1.8_kubernetes.json
+++ b/prowler/compliance/kubernetes/cis_1.8_kubernetes.json
@@ -10,7 +10,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -31,7 +31,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -52,7 +52,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -73,7 +73,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -94,7 +94,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -115,7 +115,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -136,7 +136,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -157,7 +157,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -178,7 +178,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -199,7 +199,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -220,7 +220,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -241,7 +241,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -262,7 +262,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -283,7 +283,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -304,7 +304,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -325,7 +325,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -346,7 +346,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -367,7 +367,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -388,7 +388,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -409,7 +409,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -430,7 +430,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.1 Control Plane Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -453,7 +453,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -476,7 +476,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -499,7 +499,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -522,7 +522,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -545,7 +545,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -568,7 +568,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -591,7 +591,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -614,7 +614,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -637,7 +637,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -660,7 +660,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -683,7 +683,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -706,7 +706,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
@@ -729,7 +729,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Automated",
@@ -752,7 +752,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Automated",
@@ -775,7 +775,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Automated",
@@ -798,7 +798,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -821,7 +821,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -844,7 +844,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -867,7 +867,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -890,7 +890,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -913,7 +913,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -936,7 +936,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -959,7 +959,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -982,7 +982,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -1005,7 +1005,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -1028,7 +1028,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -1051,7 +1051,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -1074,7 +1074,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -1095,7 +1095,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -1118,7 +1118,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.2 API Server",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -1141,7 +1141,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.3 Controller Manager",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -1164,7 +1164,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.3 Controller Manager",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -1187,7 +1187,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.3 Controller Manager",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -1210,7 +1210,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.3 Controller Manager",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -1233,7 +1233,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.3 Controller Manager",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -1256,7 +1256,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.3 Controller Manager",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -1279,7 +1279,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.3 Controller Manager",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -1302,7 +1302,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.4 Scheduler",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -1325,7 +1325,7 @@
       ],
       "Attributes": [
         {
-          "Section": "1. Control Plane Components",
+          "Section": "1 Control Plane Components",
           "SubSection": "1.4 Scheduler",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -1500,7 +1500,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Control Plane Configuration",
+          "Section": "3 Control Plane Configuration",
           "SubSection": "3.1 Authentication and Authorization",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -1521,7 +1521,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Control Plane Configuration",
+          "Section": "3 Control Plane Configuration",
           "SubSection": "3.1 Authentication and Authorization",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -1542,7 +1542,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Control Plane Configuration",
+          "Section": "3 Control Plane Configuration",
           "SubSection": "3.1 Authentication and Authorization",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -1563,7 +1563,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Control Plane Configuration",
+          "Section": "3 Control Plane Configuration",
           "SubSection": "3.2 Logging",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -1584,7 +1584,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3. Control Plane Configuration",
+          "Section": "3 Control Plane Configuration",
           "SubSection": "3.2 Logging",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
@@ -1607,7 +1607,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.1 Worker Node Configuration Files",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -1630,7 +1630,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.1 Worker Node Configuration Files",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
@@ -1651,7 +1651,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.1 Worker Node Configuration Files",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
@@ -1672,7 +1672,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.1 Worker Node Configuration Files",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
@@ -1695,7 +1695,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.1 Worker Node Configuration Files",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
@@ -1718,7 +1718,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.1 Worker Node Configuration Files",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
@@ -1739,7 +1739,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.1 Worker Node Configuration Files",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
@@ -1760,7 +1760,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.1 Worker Node Configuration Files",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
@@ -1783,7 +1783,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.1 Worker Node Configuration Files",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
@@ -1806,7 +1806,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.1 Worker Node Configuration Files",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
@@ -1829,7 +1829,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
@@ -1852,7 +1852,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
@@ -1875,7 +1875,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
@@ -1898,7 +1898,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
@@ -1921,7 +1921,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
@@ -1944,7 +1944,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
@@ -1965,7 +1965,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
@@ -1988,7 +1988,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.2 Kubelet",
           "Profile": "Level 2 - Worker Node",
           "AssessmentStatus": "Manual",
@@ -2011,7 +2011,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
@@ -2034,7 +2034,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Automated",
@@ -2055,7 +2055,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
@@ -2078,7 +2078,7 @@
       ],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
@@ -2099,7 +2099,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "4. Worker Nodes",
+          "Section": "4 Worker Nodes",
           "SubSection": "4.2 Kubelet",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
@@ -2122,7 +2122,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2145,7 +2145,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2168,7 +2168,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Worker Node",
           "AssessmentStatus": "Manual",
@@ -2191,7 +2191,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2212,7 +2212,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2233,7 +2233,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2254,7 +2254,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2275,7 +2275,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2298,7 +2298,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2321,7 +2321,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2344,7 +2344,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2367,7 +2367,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2390,7 +2390,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.1 RBAC and Service Accounts",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2411,7 +2411,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.2 Pod Security Standards",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2434,7 +2434,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.2 Pod Security Standards",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2457,7 +2457,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.2 Pod Security Standards",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -2480,7 +2480,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.2 Pod Security Standards",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -2503,7 +2503,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.2 Pod Security Standards",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -2526,7 +2526,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.2 Pod Security Standards",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -2549,7 +2549,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.2 Pod Security Standards",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Automated",
@@ -2572,7 +2572,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.2 Pod Security Standards",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -2595,7 +2595,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.2 Pod Security Standards",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Automated",
@@ -2618,7 +2618,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.2 Pod Security Standards",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2641,7 +2641,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.2 Pod Security Standards",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2662,7 +2662,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.2 Pod Security Standards",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2685,7 +2685,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.2 Pod Security Standards",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2706,7 +2706,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.3 Network Policies and CNI",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2727,7 +2727,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.3 Network Policies and CNI",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2750,7 +2750,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.4 Secrets Management",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2771,7 +2771,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.4 Secrets Management",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2792,7 +2792,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.4 Secrets Management",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2813,7 +2813,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.7 General Policies",
           "Profile": "Level 1 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2836,7 +2836,7 @@
       ],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.7 General Policies",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2857,7 +2857,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.7 General Policies",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
@@ -2878,7 +2878,7 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5. Policies",
+          "Section": "5 Policies",
           "SubSection": "5.7 General Policies",
           "Profile": "Level 2 - Master Node",
           "AssessmentStatus": "Manual",
diff --git a/prowler/compliance/m365/cis_4.0_m365.json b/prowler/compliance/m365/cis_4.0_m365.json
index 494f11b6ca..2612148782 100644
--- a/prowler/compliance/m365/cis_4.0_m365.json
+++ b/prowler/compliance/m365/cis_4.0_m365.json
@@ -12,7 +12,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1.1",
+          "Section": "1 Microsoft 365 admin center",
+          "SubSection": "1.1 Users",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Administrative accounts are special privileged accounts that could have varying levels of access to data, users, and settings. Regular user accounts should never be utilized for administrative tasks and care should be taken, in the case of a hybrid environment, to keep Administrative accounts separated from on-prem accounts. Administrative accounts should not have applications assigned so that they have no access to potentially vulnerable services (EX. email, Teams, SharePoint, etc.) and only access to perform tasks as needed for administrative purposes.Ensure administrative accounts are not `On-premises sync enabled`.",
@@ -32,7 +33,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1.1",
+          "Section": "1 Microsoft 365 admin center",
+          "SubSection": "1.1 Users",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Emergency access or \"break glass\" accounts are limited for emergency scenarios where normal administrative accounts are unavailable. They are not assigned to a specific user and will have a combination of physical and technical controls to prevent them from being accessed outside a true emergency. These emergencies could be due to several things, including:- Technical failures of a cellular provider or Microsoft related service such as MFA.- The last remaining Global Administrator account is inaccessible.Ensure two `Emergency Access` accounts have been defined.**Note:** Microsoft provides several recommendations for these accounts and how to configure them. For more information on this, please refer to the references section. The CIS Benchmark outlines the more critical things to consider.",
@@ -54,7 +56,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1.1",
+          "Section": "1 Microsoft 365 admin center",
+          "SubSection": "1.1 Users",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "More than one global administrator should be designated so a single admin can be monitored and to provide redundancy should a single admin leave an organization. Additionally, there should be no more than four global admins set for any tenant. Ideally global administrators will have no licenses assigned to them.",
@@ -76,7 +79,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1.1",
+          "Section": "1 Microsoft 365 admin center",
+          "SubSection": "1.1 Users",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Administrative accounts are special privileged accounts that could have varying levels of access to data, users, and settings. A license can enable an account to gain access to a variety of different applications, depending on the license assigned.The recommended state is to not license a privileged account or use `Microsoft Entra ID P1` or `Microsoft Entra ID P2` licenses.",
@@ -98,7 +102,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1.2",
+          "Section": "1 Microsoft 365 admin center",
+          "SubSection": "1.2 Teams & groups",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Microsoft 365 Groups is the foundational membership service that drives all teamwork across Microsoft 365. With Microsoft 365 Groups, you can give a group of people access to a collection of shared resources. While there are several different group types this recommendation concerns **Microsoft 365 Groups**.In the Administration panel, when a group is created, the default privacy value is \"Public\".",
@@ -118,7 +123,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1.2",
+          "Section": "1 Microsoft 365 admin center",
+          "SubSection": "1.2 Teams & groups",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Shared mailboxes are used when multiple people need access to the same mailbox, such as a company information or support email address, reception desk, or other function that might be shared by multiple people.Users with permissions to the group mailbox can send as or send on behalf of the mailbox email address if the administrator has given that user permissions to do that. This is particularly useful for help and support mailboxes because users can send emails from \"Contoso Support\" or \"Building A Reception Desk.\"Shared mailboxes are created with a corresponding user account using a system generated password that is unknown at the time of creation.The recommended state is `Sign in blocked` for `Shared mailboxes`.",
@@ -140,7 +146,8 @@
       ],
       "Attributes": [
         {
-          "Section": "1.3",
+          "Section": "1 Microsoft 365 admin center",
+          "SubSection": "1.3 Settings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Microsoft cloud-only accounts have a pre-defined password policy that cannot be changed. The only items that can change are the number of days until a password expires and whether or whether passwords expire at all.",
@@ -160,7 +167,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1.3",
+          "Section": "1 Microsoft 365 admin center",
+          "SubSection": "1.3 Settings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Idle session timeout allows the configuration of a setting which will timeout inactive users after a pre-determined amount of time. When a user reaches the set idle timeout session, they'll get a notification that they're about to be signed out. They have to select to stay signed in or they'll be automatically signed out of all Microsoft 365 web apps. Combined with a Conditional Access rule this will only impact unmanaged devices. A managed device is considered a device managed that is compliant or joined to a domain and using a supported browser like Microsoft Edge or Google Chrome (with the Microsoft Single Sign On) extension.The following Microsoft 365 web apps are supported.- Outlook Web App- OneDrive- SharePoint- Microsoft Fabric- Microsoft365.com and other start pages- Microsoft 365 web apps (Word, Excel, PowerPoint)- Microsoft 365 Admin Center- M365 Defender Portal- Microsoft Purview Compliance PortalThe recommended setting is `3 hours` (or less) for unmanaged devices. **Note:** Idle session timeout doesn't affect Microsoft 365 desktop and mobile apps.",
@@ -180,7 +188,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1.3",
+          "Section": "1 Microsoft 365 admin center",
+          "SubSection": "1.3 Settings",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "External calendar sharing allows an administrator to enable the ability for users to share calendars with anyone outside of the organization. Outside users will be sent a URL that can be used to view the calendar.",
@@ -200,7 +209,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1.3",
+          "Section": "1 Microsoft 365 admin center",
+          "SubSection": "1.3 Settings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "By default, users can install add-ins in their Microsoft Word, Excel, and PowerPoint applications, allowing data access within the application.Do not allow users to install add-ins in Word, Excel, or PowerPoint.",
@@ -220,7 +230,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1.3",
+          "Section": "1 Microsoft 365 admin center",
+          "SubSection": "1.3 Settings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Microsoft Forms can be used for phishing attacks by asking personal or sensitive information and collecting the results. Microsoft 365 has built-in protection that will proactively scan for phishing attempt in forms such personal information request.",
@@ -240,7 +251,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1.3",
+          "Section": "1 Microsoft 365 admin center",
+          "SubSection": "1.3 Settings",
           "Profile": "E5 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Customer Lockbox is a security feature that provides an additional layer of control and transparency to customer data in Microsoft 365. It offers an approval process for Microsoft support personnel to access organization data and creates an audited trail to meet compliance requirements.",
@@ -260,7 +272,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1.3",
+          "Section": "1 Microsoft 365 admin center",
+          "SubSection": "1.3 Settings",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Third-party storage can be enabled for users in Microsoft 365, allowing them to store and share documents using services such as Dropbox, alongside OneDrive and team sites.Ensure `Microsoft 365 on the web` third-party storage services are restricted.",
@@ -280,7 +293,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "1.3",
+          "Section": "1 Microsoft 365 admin center",
+          "SubSection": "1.3 Settings",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Sway is a Microsoft 365 app that lets organizations create interactive, web-based presentations using images, text, videos and other media. Its design engine simplifies the process, allowing for quick customization. Presentations can then be shared via a link.This setting controls user Sway sharing capability, both within and outside of the organization. By default, Sway is enabled for everyone in the organization.",
@@ -300,7 +314,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2.1",
+          "Section": "2 Microsoft 365 Defender",
+          "SubSection": "2.1 Email & collaboration",
           "Profile": "E5 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Enabling Safe Links policy for Office applications allows URL's that exist inside of Office documents and email applications opened by Office, Office Online and Office mobile to be processed against Defender for Office time-of-click verification and rewritten if required.**Note:** E5 Licensing includes a number of Built-in Protection policies. When auditing policies note which policy you are viewing, and keep in mind CIS recommendations often extend the Default or Build-in Policies provided by MS. In order to **Pass** the highest priority policy must match all settings recommended.",
@@ -322,7 +337,8 @@
       ],
       "Attributes": [
         {
-          "Section": "2.1",
+          "Section": "2 Microsoft 365 Defender",
+          "SubSection": "2.1 Email & collaboration",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The Common Attachment Types Filter lets a user block known and custom malicious file types from being attached to emails.",
@@ -344,7 +360,8 @@
       ],
       "Attributes": [
         {
-          "Section": "2.1",
+          "Section": "2 Microsoft 365 Defender",
+          "SubSection": "2.1 Email & collaboration",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Exchange Online Protection (EOP) is the cloud-based filtering service that protects organizations against spam, malware, and other email threats. EOP is included in all Microsoft 365 organizations with Exchange Online mailboxes.EOP uses flexible anti-malware policies for malware protection settings. These policies can be set to notify Admins of malicious activity.",
@@ -364,7 +381,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2.1",
+          "Section": "2 Microsoft 365 Defender",
+          "SubSection": "2.1 Email & collaboration",
           "Profile": "E5 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "The Safe Attachments policy helps protect users from malware in email attachments by scanning attachments for viruses, malware, and other malicious content. When an email attachment is received by a user, Safe Attachments will scan the attachment in a secure environment and provide a verdict on whether the attachment is safe or not.",
@@ -384,7 +402,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2.1",
+          "Section": "2 Microsoft 365 Defender",
+          "SubSection": "2.1 Email & collaboration",
           "Profile": "E5 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Safe Attachments for SharePoint, OneDrive, and Microsoft Teams scans these services for malicious files.",
@@ -406,7 +425,8 @@
       ],
       "Attributes": [
         {
-          "Section": "2.1",
+          "Section": "2 Microsoft 365 Defender",
+          "SubSection": "2.1 Email & collaboration",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, email messages are automatically protected against spam (junk email) by EOP.Configure Exchange Online Spam Policies to copy emails and notify someone when a sender in the organization has been blocked for sending spam emails.",
@@ -428,7 +448,8 @@
       ],
       "Attributes": [
         {
-          "Section": "2.1",
+          "Section": "2 Microsoft 365 Defender",
+          "SubSection": "2.1 Email & collaboration",
           "Profile": "E5 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "By default, Office 365 includes built-in features that help protect users from phishing attacks. Set up anti-phishing polices to increase this protection, for example by refining settings to better detect and prevent impersonation and spoofing attacks. The default policy applies to all users within the organization and is a single view to fine-tune anti-phishing protection. Custom policies can be created and configured for specific users, groups or domains within the organization and will take precedence over the default policy for the scoped users.",
@@ -450,7 +471,8 @@
       ],
       "Attributes": [
         {
-          "Section": "2.1",
+          "Section": "2 Microsoft 365 Defender",
+          "SubSection": "2.1 Email & collaboration",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "For each domain that is configured in Exchange, a corresponding Sender Policy Framework (SPF) record should be created.",
@@ -472,7 +494,8 @@
       ],
       "Attributes": [
         {
-          "Section": "2.1",
+          "Section": "2 Microsoft 365 Defender",
+          "SubSection": "2.1 Email & collaboration",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "DKIM is one of the trio of Authentication methods (SPF, DKIM and DMARC) that help prevent attackers from sending messages that look like they come from your domain. DKIM lets an organization add a digital signature to outbound email messages in the message header. When DKIM is configured, the organization authorizes it's domain to associate, or sign, its name to an email message using cryptographic authentication. Email systems that get email from this domain can use a digital signature to help verify whether incoming email is legitimate.Use of DKIM in addition to SPF and DMARC to help prevent malicious actors using spoofing techniques from sending messages that look like they are coming from your domain.",
@@ -492,7 +515,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2.1",
+          "Section": "2 Microsoft 365 Defender",
+          "SubSection": "2.1 Email & collaboration",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "DMARC, or Domain-based Message Authentication, Reporting, and Conformance, assists recipient mail systems in determining the appropriate action to take when messages from a domain fail to meet SPF or DKIM authentication criteria.",
@@ -514,7 +538,8 @@
       ],
       "Attributes": [
         {
-          "Section": "2.1",
+          "Section": "2 Microsoft 365 Defender",
+          "SubSection": "2.1 Email & collaboration",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "The Common Attachment Types Filter lets a user block known and custom malicious file types from being attached to emails. The policy provided by Microsoft covers 53 extensions, and an additional custom list of extensions can be defined.The list of 186 extensions provided in this recommendation is comprehensive but not exhaustive.",
@@ -536,7 +561,8 @@
       ],
       "Attributes": [
         {
-          "Section": "2.1",
+          "Section": "2 Microsoft 365 Defender",
+          "SubSection": "2.1 Email & collaboration",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "In Microsoft 365 organizations with Exchange Online mailboxes or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, connection filtering and the default connection filter policy identify good or bad source email servers by IP addresses. The key components of the default connection filter policy are **IP Allow List**, **IP Block List** and **Safe list**.The recommended state is `IP Allow List` empty or undefined.",
@@ -558,7 +584,8 @@
       ],
       "Attributes": [
         {
-          "Section": "2.1",
+          "Section": "2 Microsoft 365 Defender",
+          "SubSection": "2.1 Email & collaboration",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "In Microsoft 365 organizations with Exchange Online mailboxes or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, connection filtering and the default connection filter policy identify good or bad source email servers by IP addresses. The key components of the default connection filter policy are **IP Allow List**, **IP Block List** and **Safe list**.The safe list is a pre-configured allow list that is dynamically updated by Microsoft.The recommended safe list state is: `Off` or `False`",
@@ -580,7 +607,8 @@
       ],
       "Attributes": [
         {
-          "Section": "2.1",
+          "Section": "2 Microsoft 365 Defender",
+          "SubSection": "2.1 Email & collaboration",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Anti-spam protection is a feature of Exchange Online that utilizes policies to help to reduce the amount of junk email, bulk and phishing emails a mailbox receives. These policies contain lists to allow or block specific senders or domains. - The allowed senders list- The allowed domains list- The blocked senders list- The blocked domains listThe recommended state is: Do not define any `Allowed domains`",
@@ -600,7 +628,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2.4",
+          "Section": "2 Microsoft 365 Defender",
+          "SubSection": "2.4 System",
           "Profile": "E5 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Identify _priority accounts_ to utilize Microsoft 365's advanced custom security features. This is an essential tool to bolster protection for users who are frequently targeted due to their critical positions, such as executives, leaders, managers, or others who have access to sensitive, confidential, financial, or high-priority information.Once these accounts are identified, several services and features can be enabled, including threat policies, enhanced sign-in protection through conditional access policies, and alert policies, enabling faster response times for incident response teams.",
@@ -620,7 +649,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2.4",
+          "Section": "2 Microsoft 365 Defender",
+          "SubSection": "2.4 System",
           "Profile": "E5 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Preset security policies have been established by Microsoft, utilizing observations and experiences within datacenters to strike a balance between the exclusion of malicious content from users and limiting unwarranted disruptions. These policies can apply to all, or select users and encompass recommendations for addressing spam, malware, and phishing threats. The policy parameters are pre-determined and non-adjustable.`Strict protection` has the most aggressive protection of the 3 presets.- EOP: Anti-spam, Anti-malware and Anti-phishing- Defender: Spoof protection, Impersonation protection and Advanced phishing- Defender: Safe Links and Safe Attachments**NOTE: The preset security polices cannot target Priority account TAGS currently, groups should be used instead.**",
@@ -640,7 +670,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2.4",
+          "Section": "2 Microsoft 365 Defender",
+          "SubSection": "2.4 System",
           "Profile": "E5 Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB). It provides visibility into suspicious activity in Microsoft 365, enabling investigation into potential security issues and facilitating the implementation of remediation measures if necessary.Some risk detection methods provided by Entra Identity Protection also require Microsoft Defender for Cloud Apps:- Suspicious manipulation of inbox rules- Suspicious inbox forwarding- New country detection- Impossible travel detection- Activity from anonymous IP addresses- Mass access to sensitive files",
@@ -660,7 +691,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "2.4",
+          "Section": "2 Microsoft 365 Defender",
+          "SubSection": "2.4 System",
           "Profile": "E5 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Zero-hour auto purge (ZAP) is a protection feature that retroactively detects and neutralizes malware and high confidence phishing. When ZAP for Teams protection blocks a message, the message is blocked for everyone in the chat. The initial block happens right after delivery, but ZAP occurs up to 48 hours after delivery.",
@@ -682,7 +714,8 @@
       ],
       "Attributes": [
         {
-          "Section": "3.1",
+          "Section": "3 Microsoft Purview",
+          "SubSection": "3.1 Audit",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "When audit log search is enabled in the Microsoft Purview compliance portal, user and admin activity within the organization is recorded in the audit log and retained for 90 days. However, some organizations may prefer to use a third-party security information and event management (SIEM) application to access their auditing data. In this scenario, a global admin can choose to turn off audit log search in Microsoft 365.",
@@ -702,7 +735,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3.2",
+          "Section": "3 Microsoft Purview",
+          "SubSection": "3.1 Audit",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Data Loss Prevention (DLP) policies allow Exchange Online and SharePoint Online content to be scanned for specific types of data like social security numbers, credit card numbers, or passwords.",
@@ -722,7 +756,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3.2",
+          "Section": "3 Microsoft Purview",
+          "SubSection": "3.1 Audit",
           "Profile": "E5 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "The default Teams Data Loss Prevention (DLP) policy rule in Microsoft 365 is a preconfigured rule that is automatically applied to all Teams conversations and channels. The default rule helps prevent accidental sharing of sensitive information by detecting and blocking certain types of content that are deemed sensitive or inappropriate by the organization. By default, the rule includes a check for the sensitive info type _Credit Card Number_ which is pre-defined by Microsoft.",
@@ -742,7 +777,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "3.3",
+          "Section": "3 Microsoft Purview",
+          "SubSection": "3.3 Information protection",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "SharePoint Online Data Classification Policies enables organizations to classify and label content in SharePoint Online based on its sensitivity and business impact. This setting helps organizations to manage and protect sensitive data by automatically applying labels to content, which can then be used to apply policy-based protection and governance controls.",
@@ -762,7 +798,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5.1.1",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.1 Identity",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Security defaults in Microsoft Entra ID make it easier to be secure and help protect the organization. Security defaults contain preconfigured security settings for common attacks.By default, Microsoft enables security defaults. The goal is to ensure that all organizations have a basic level of security enabled. The security default setting is manipulated in the Entra admin center.The use of security defaults, however, will prohibit custom settings which are being set with more advanced settings from this benchmark.",
@@ -782,7 +819,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5.1.2",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.1 Identity",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Legacy per-user Multi-Factor Authentication (MFA) can be configured to require individual users to provide multiple authentication factors, such as passwords and additional verification codes, to access their accounts. It was introduced in earlier versions of Office 365, prior to the more comprehensive implementation of Conditional Access (CA).",
@@ -804,7 +842,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5.1.2",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.1 Identity",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "App registration allows users to register custom-developed applications for use within the directory.",
@@ -826,7 +865,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5.1.2",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.1 Identity",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Non-privileged users can create tenants in the Entra administration portal under Manage tenant. The creation of a tenant is recorded in the Audit log as category \"DirectoryManagement\" and activity \"Create Company\". Anyone who creates a tenant becomes the Global Administrator of that tenant. The newly created tenant doesn't inherit any settings or configurations.",
@@ -846,7 +886,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5.1.2",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.1 Identity",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Restrict non-privileged users from signing into the Microsoft Entra admin center.**Note:** This recommendation only affects access to the web portal. It does not prevent privileged users from using other methods such as Rest API or PowerShell to obtain information. Those channels are addressed elsewhere in this document.",
@@ -866,7 +907,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5.1.2",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.1 Identity",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Manual",
           "Description": "The option for the user to `Stay signed in`, or the `Keep me signed in` option, will prompt a user after a successful login. When the user selects this option, a persistent refresh token is created. The refresh token lasts for 90 days by default and does not prompt for sign-in or multifactor.",
@@ -886,7 +928,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5.1.2",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.1 Identity",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Manual",
           "Description": "LinkedIn account connections allow users to connect their Microsoft work or school account with LinkedIn. After a user connects their accounts, information and highlights from LinkedIn are available in some Microsoft apps and services.",
@@ -908,7 +951,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5.1.3",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.1 Identity",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "A dynamic group is a dynamic configuration of security group membership for Microsoft Entra ID. Administrators can set rules to populate groups that are created in Entra ID based on user attributes (such as userType, department, or country/region). Members can be automatically added to or removed from a security group based on their attributes.The recommended state is to create a dynamic group that includes guest accounts.",
@@ -930,7 +974,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5.1.5",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.1 Identity",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Control when end users and group owners are allowed to grant consent to applications, and when they will be required to request administrator review and approval. Allowing users to grant apps access to data helps them acquire useful applications and be productive but can represent a risk in some situations if it's not monitored and controlled carefully.",
@@ -952,7 +997,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5.1.5",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.1 Identity",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "The admin consent workflow gives admins a secure way to grant access to applications that require admin approval. When a user tries to access an application but is unable to provide consent, they can send a request for admin approval. The request is sent via email to admins who have been designated as reviewers. A reviewer takes action on the request, and the user is notified of the action.",
@@ -972,7 +1018,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5.1.6",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.1 Identity",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Manual",
           "Description": "B2B collaboration is a feature within Microsoft Entra External ID that allows for guest invitations to an organization.Ensure users can only send invitations to `specified domains`.**Note:** This list works independently from OneDrive for Business and SharePoint Online allow/block lists. To restrict individual file sharing in SharePoint Online, set up an allow or blocklist for OneDrive for Business and SharePoint Online. For instance, in SharePoint or OneDrive users can still share with external users from prohibited domains by using Anyone links if they haven't been disabled.",
@@ -994,7 +1041,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5.1.6",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.1 Identity",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Microsoft Entra ID, part of Microsoft Entra, allows you to restrict what external guest users can see in their organization in Microsoft Entra ID. Guest users are set to a limited permission level by default in Microsoft Entra ID, while the default for member users is the full set of user permissions. These directory level permissions are enforced across Microsoft Entra services including Microsoft Graph, PowerShell v2, the Azure portal, and My Apps portal. Microsoft 365 services leveraging Microsoft 365 groups for collaboration scenarios are also affected, specifically Outlook, Microsoft Teams, and SharePoint. They do not override the SharePoint or Microsoft Teams guest settings.The recommended state is at least `Guest users have limited access to properties and memberships of directory objects` or more restrictive.",
@@ -1016,7 +1064,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5.1.6",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.1 Identity",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "By default, all users in the organization, including B2B collaboration guest users, can invite external users to B2B collaboration. The ability to send invitations can be limited by turning it on or off for everyone, or by restricting invitations to certain roles.The recommended state for guest invite restrictions is `Only users assigned to specific admin roles can invite guest users`.",
@@ -1038,7 +1087,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5.1.8",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.1 Identity",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Password hash synchronization is one of the sign-in methods used to accomplish hybrid identity synchronization. Microsoft Entra Connect synchronizes a hash, of the hash, of a user's password from an on-premises Active Directory instance to a cloud-based Entra ID instance.**Note:** Audit and remediation procedures in this recommendation only apply to Microsoft 365 tenants operating in a hybrid configuration using Entra Connect sync, and does not apply to federated domains.",
@@ -1060,7 +1110,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5.2.2",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.2 Protection",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Multifactor authentication is a process that requires an additional form of identification during the sign-in process, such as a code from a mobile device or a fingerprint scan, to enhance security.Ensure users in administrator roles have MFA capabilities enabled.",
@@ -1082,7 +1133,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5.2.2",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.2 Protection",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Enable multifactor authentication for all users in the Microsoft 365 tenant. Users will be prompted to authenticate with a second factor upon logging in to Microsoft 365 services. The second factor is most commonly a text message to a registered mobile phone number where they type in an authorization code, or with a mobile application like Microsoft Authenticator.",
@@ -1104,7 +1156,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5.2.2",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.2 Protection",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Entra ID supports the most widely used authentication and authorization protocols including legacy authentication. This authentication pattern includes basic authentication, a widely used industry-standard method for collecting username and password information.The following messaging protocols support legacy authentication:- Authenticated SMTP - Used to send authenticated email messages.- Autodiscover - Used by Outlook and EAS clients to find and connect to mailboxes in Exchange Online.- Exchange ActiveSync (EAS) - Used to connect to mailboxes in Exchange Online.- Exchange Online PowerShell - Used to connect to Exchange Online with remote PowerShell. If you block Basic authentication for Exchange Online PowerShell, you need to use the Exchange Online PowerShell Module to connect. For instructions, see Connect to Exchange Online PowerShell using multifactor authentication.- Exchange Web Services (EWS) - A programming interface that's used by Outlook, Outlook for Mac, and third-party apps.- IMAP4 - Used by IMAP email clients.- MAPI over HTTP (MAPI/HTTP) - Primary mailbox access protocol used by Outlook 2010 SP2 and later.- Offline Address Book (OAB) - A copy of address list collections that are downloaded and used by Outlook.- Outlook Anywhere (RPC over HTTP) - Legacy mailbox access protocol supported by all current Outlook versions.- POP3 - Used by POP email clients.- Reporting Web Services - Used to retrieve report data in Exchange Online.- Universal Outlook - Used by the Mail and Calendar app for Windows 10.- Other clients - Other protocols identified as utilizing legacy authentication.",
@@ -1126,7 +1179,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5.2.2",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.2 Protection",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "In complex deployments, organizations might have a need to restrict authentication sessions. Conditional Access policies allow for the targeting of specific user accounts. Some scenarios might include:- Resource access from an unmanaged or shared device- Access to sensitive information from an external network- High-privileged users- Business-critical applicationsEnsure Sign-in frequency periodic reauthentication does not exceed `4 hours` for E3 tenants, or `24 hours` for E5 tenants using Privileged Identity Management.Ensure `Persistent browser session` is set to `Never persistent`**Note:** This CA policy can be added to the previous CA policy in this benchmark \"Ensure multifactor authentication is enabled for all users in administrative roles\"",
@@ -1148,7 +1202,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5.2.2",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.2 Protection",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Authentication strength is a Conditional Access control that allows administrators to specify which combination of authentication methods can be used to access a resource. For example, they can make only phishing-resistant authentication methods available to access a sensitive resource. But to access a non-sensitive resource, they can allow less secure multifactor authentication (MFA) combinations, such as password + SMS.Microsoft has 3 built-in authentication strengths. MFA strength, Passwordless MFA strength, and Phishing-resistant MFA strength. Ensure administrator roles are using a CA policy with `Phishing-resistant MFA strength`.Administrators can then enroll using one of 3 methods:- FIDO2 Security Key- Windows Hello for Business- Certificate-based authentication (Multi-Factor)**Note:** Additional steps to configure methods such as FIDO2 keys are not covered here but can be found in related MS articles in the references section. The Conditional Access policy only ensures 1 of the 3 methods is used.**Warning:** Administrators should be pre-registered for a strong authentication mechanism before this Conditional Access Policy is enforced. Additionally, as stated elsewhere in the CIS Benchmark a break-glass administrator account should be excluded from this policy to ensure unfettered access in the case of an emergency.",
@@ -1170,7 +1225,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5.2.2",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.2 Protection",
           "Profile": "E5 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Microsoft Entra ID Protection user risk policies detect the probability that a user account has been compromised. **Note:** While Identity Protection also provides two risk policies with limited conditions, Microsoft highly recommends setting up risk-based policies in Conditional Access as opposed to the \"legacy method\" for the following benefits:- Enhanced diagnostic data- Report-only mode integration- Graph API support- Use more Conditional Access attributes like sign-in frequency in the policy",
@@ -1192,7 +1248,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5.2.2",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.2 Protection",
           "Profile": "E5 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Microsoft Entra ID Protection sign-in risk detects risks in real-time and offline. A risky sign-in is an indicator for a sign-in attempt that might not have been performed by the legitimate owner of a user account.**Note:** While Identity Protection also provides two risk policies with limited conditions, Microsoft highly recommends setting up risk-based policies in Conditional Access as opposed to the \"legacy method\" for the following benefits:- Enhanced diagnostic data- Report-only mode integration- Graph API support- Use more Conditional Access attributes like sign-in frequency in the policy",
@@ -1214,7 +1271,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5.2.2",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.2 Protection",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Manual",
           "Description": "When a Conditional Access policy targets the Microsoft Admin Portals cloud app, the policy is enforced for tokens issued to application IDs of the following Microsoft administrative portals:- Azure portal- Exchange admin center- Microsoft 365 admin center- Microsoft 365 Defender portal- Microsoft Entra admin center- Microsoft Intune admin center- Microsoft Purview compliance portal- Power Platform admin center- SharePoint admin center- Microsoft Teams admin center`Microsoft Admin Portals` should be restricted to specific pre-determined administrative roles.",
@@ -1234,7 +1292,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5.2.2",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.2 Protection",
           "Profile": "E5 Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Microsoft Entra ID Protection sign-in risk detects risks in real-time and offline. A risky sign-in is an indicator for a sign-in attempt that might not have been performed by the legitimate owner of a user account.**Note:** While Identity Protection also provides two risk policies with limited conditions, Microsoft highly recommends setting up risk-based policies in Conditional Access as opposed to the \"legacy method\" for the following benefits:- Enhanced diagnostic data- Report-only mode integration- Graph API support- Use more Conditional Access attributes like sign-in frequency in the policy",
@@ -1256,7 +1315,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5.2.2",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.2 Protection",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Conditional Access (CA) can be configured to enforce access based on the device's compliance status or whether it is Entra hybrid joined. Collectively this allows CA to classify devices as managed or unmanaged, providing more granular control over authentication policies.When using `Require device to be marked as compliant`, the device must pass checks configured in **Compliance** policies defined within Intune (Endpoint Manager). Before these checks can be applied, the device must first be enrolled in Intune MDM.By selecting `Require Microsoft Entra hybrid joined device` this means the device must first be synchronized from an on-premises Active Directory to qualify for authentication.When configured to the recommended state below only one condition needs to be met for the user to authenticate from the device. This functions as an \"OR\" operator.The recommended state is:- `Require device to be marked as compliant`- `Require Microsoft Entra hybrid joined device`- `Require one of the selected controls`",
@@ -1278,7 +1338,8 @@
       ],
       "Attributes": [
         {
-          "Section": "5.2.2",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.2 Protection",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Conditional Access (CA) can be configured to enforce access based on the device's compliance status or whether it is Entra hybrid joined. Collectively this allows CA to classify devices as managed or not, providing more granular control over whether or not a user can register MFA on a device.When using `Require device to be marked as compliant`, the device must pass checks configured in **Compliance** policies defined within Intune (Endpoint Manager). Before these checks can be applied, the device must first be enrolled in Intune MDM.By selecting `Require Microsoft Entra hybrid joined device` this means the device must first be synchronized from an on-premises Active Directory to qualify for authentication.When configured to the recommended state below only one condition needs to be met for the user to register MFA from the device. This functions as an \"OR\" operator.The recommended state is to restrict `Register security information` to a device that is marked as compliant or Entra hybrid joined.",
@@ -1298,7 +1359,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5.2.3",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.2 Protection",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Microsoft has released additional settings to enhance the configuration of the Microsoft Authenticator application. These settings provide additional information and context to users who receive MFA passwordless and push requests, such as geographic location the request came from, the requesting application and requiring a number match.Ensure the following are `Enabled`.- `Require number matching for push notifications`- `Show application name in push and passwordless notifications`- `Show geographic location in push and passwordless notifications`**NOTE:** On February 27, 2023 Microsoft started enforcing number matching tenant-wide for all users using Microsoft Authenticator.",
@@ -1318,7 +1380,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5.2.3",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.2 Protection",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "With Entra Password Protection, default global banned password lists are automatically applied to all users in an Entra ID tenant. To support business and security needs, custom banned password lists can be defined. When users change or reset their passwords, these banned password lists are checked to enforce the use of strong passwords.A custom banned password list should include some of the following examples:- Brand names- Product names- Locations, such as company headquarters- Company-specific internal terms- Abbreviations that have specific company meaning",
@@ -1338,7 +1401,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5.2.3",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.2 Protection",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Microsoft Entra Password Protection provides a global and custom banned password list. A password change request fails if there's a match in these banned password list. To protect on-premises Active Directory Domain Services (AD DS) environment, install and configure Entra Password Protection.**Note**: This recommendation applies to Hybrid deployments only and will have no impact unless working with on-premises Active Directory.",
@@ -1358,7 +1422,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5.2.3",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.2 Protection",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Microsoft defines Multifactor authentication capable as being registered and enabled for a strong authentication method. The method must also be allowed by the authentication methods policy.Ensure all member users are `MFA capable`.",
@@ -1378,7 +1443,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5.2.3",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.2 Protection",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Authentication methods support a wide variety of scenarios for signing in to Microsoft 365 resources. Some of these methods are inherently more secure than others but require more investment in time to get users enrolled and operational.SMS and Voice Call rely on telephony carrier communication methods to deliver the authenticating factor.The email one-time passcode feature is a way to authenticate B2B collaboration users when they can't be authenticated through other means, such as Microsoft Entra ID, Microsoft account (MSA), or social identity providers. When a B2B guest user tries to redeem your invitation or sign in to your shared resources, they can request a temporary passcode, which is sent to their email address. Then they enter this passcode to continue signing in.The recommended state is to `Disable` these methods:- SMS- Voice Call- Email OTP",
@@ -1398,7 +1464,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5.2.4",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.2 Protection",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Enabling self-service password reset allows users to reset their own passwords in Entra ID. When users sign in to Microsoft 365, they will be prompted to enter additional contact information that will help them reset their password in the future. If combined registration is enabled additional information, outside of multi-factor, will not be needed. **Note:** Effective Oct. 1st, 2022, Microsoft will begin to enable combined registration for all users in Entra ID tenants created before August 15th, 2020. Tenants created after this date are enabled with combined registration by default.",
@@ -1418,7 +1485,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5.3",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.3 Identity Governance",
           "Profile": "E5 Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Microsoft Entra Privileged Identity Management can be used to audit roles, allow just in time activation of roles and allow for periodic role attestation. Organizations should remove permanent members from privileged Office 365 roles and instead make them eligible, through a JIT activation workflow.",
@@ -1438,7 +1506,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5.3",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.3 Identity Governance",
           "Profile": "E5 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Access reviews enable administrators to establish an efficient automated process for reviewing group memberships, access to enterprise applications, and role assignments. These reviews can be scheduled to recur regularly, with flexible options for delegating the task of reviewing membership to different members of the organization.Ensure `Access reviews` for Guest Users are configured to be performed no less frequently than `monthly`.",
@@ -1458,7 +1527,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5.3",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.3 Identity Governance",
           "Profile": "E5 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Access reviews enable administrators to establish an efficient automated process for reviewing group memberships, access to enterprise applications, and role assignments. These reviews can be scheduled to recur regularly, with flexible options for delegating the task of reviewing membership to different members of the organization.Ensure `Access reviews` for high privileged Entra ID roles are done `monthly` or more frequently. These reviews should include **at a minimum** the roles listed below:- Global Administrator- Exchange Administrator- SharePoint Administrator- Teams Administrator- Security Administrator**Note:** An access review is created for each role selected after completing the process.",
@@ -1478,7 +1548,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "5.3",
+          "Section": "5 Microsoft Entra admin center",
+          "SubSection": "5.3 Identity Governance",
           "Profile": "E5 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Microsoft Entra Privileged Identity Management can be used to audit roles, allow just in time activation of roles and allow for periodic role attestation. Requiring approval before activation allows one of the selected approvers to first review and then approve the activation prior to PIM granted the role. The approver doesn't have to be a group member or owner.The recommended state is `Require approval to activate` for the Global Administrator role.",
@@ -1500,7 +1571,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6.1",
+          "Section": "6 Exchange admin center",
+          "SubSection": "6.1 Audit",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The value False indicates that mailbox auditing on by default is turned on for the organization. Mailbox auditing on by default in the organization overrides the mailbox auditing settings on individual mailboxes. For example, if mailbox auditing is turned off for a mailbox (the AuditEnabled property on the mailbox is False), the default mailbox actions are still audited for the mailbox, because mailbox auditing on by default is turned on for the organization.Turning off mailbox auditing on by default ($true) has the following results:- Mailbox auditing is turned off for your organization.- From the time you turn off mailbox auditing on by default, no mailbox actions are audited, even if mailbox auditing is enabled on a mailbox (the AuditEnabled property on the mailbox is True).- Mailbox auditing isn't turned on for new mailboxes and setting the AuditEnabled property on a new or existing mailbox to True is ignored.- Any mailbox audit bypass association settings (configured by using the Set-MailboxAuditBypassAssociation cmdlet) are ignored.- Existing mailbox audit records are retained until the audit log age limit for the record expires.The recommended state for this setting is `False` at the organization level. This will enable auditing and enforce the default.",
@@ -1522,7 +1594,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6.1",
+          "Section": "6 Exchange admin center",
+          "SubSection": "6.1 Audit",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Mailbox audit logging is turned on by default in all organizations. This effort started in January 2019, and means that certain actions performed by mailbox owners, delegates, and admins are automatically logged. The corresponding mailbox audit records are available for admins to search in the mailbox audit log. Mailboxes and shared mailboxes have actions assigned to them individually in order to audit the data the organization determines valuable at the mailbox level.The recommended state is `AuditEnabled` to `True` on all user mailboxes along with additional audit actions beyond the Microsoft defaults.**Note:** Due to some differences in defaults for audit actions this recommendation is specific to users assigned an E3 license only.",
@@ -1544,7 +1617,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6.1",
+          "Section": "6 Exchange admin center",
+          "SubSection": "6.1 Audit",
           "Profile": "E5 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Mailbox audit logging is turned on by default in all organizations. This effort started in January 2019, and means that certain actions performed by mailbox owners, delegates, and admins are automatically logged. The corresponding mailbox audit records are available for admins to search in the mailbox audit log. Mailboxes and shared mailboxes have actions assigned to them individually in order to audit the data the organization determines valuable at the mailbox level.The recommended state is `AuditEnabled` to `True` on all user mailboxes along with additional audit actions beyond the Microsoft defaults.Note: Due to some differences in defaults for audit actions this recommendation is specific to users assigned an E5 license, or auditing addon license, only.",
@@ -1566,7 +1640,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6.1",
+          "Section": "6 Exchange admin center",
+          "SubSection": "6.1 Audit",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "When configuring a user or computer account to bypass mailbox audit logging, the system will not record any access, or actions performed by the said user or computer account on any mailbox. Administratively this was introduced to reduce the volume of entries in the mailbox audit logs on trusted user or computer accounts.Ensure `AuditBypassEnabled` is not enabled on accounts without a written exception.",
@@ -1589,7 +1664,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6.2",
+          "Section": "6 Exchange admin center",
+          "SubSection": "6.2 Mail Flow",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Exchange Online offers several methods of managing the flow of email messages. These are Remote domain, Transport Rules, and Anti-spam outbound policies. These methods work together to provide comprehensive coverage for potential automatic forwarding channels:- Outlook forwarding using inbox rules.- Outlook forwarding configured using OOF rule.- OWA forwarding setting (ForwardingSmtpAddress).- Forwarding set by the admin using EAC (ForwardingAddress).- Forwarding using Power Automate / Flow.Ensure a `Transport rule` and `Anti-spam outbound policy` are used to block mail forwarding.**NOTE:** Any exclusions should be implemented based on organizational policy.",
@@ -1611,7 +1687,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6.2",
+          "Section": "6 Exchange admin center",
+          "SubSection": "6.2 Mail Flow",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Mail flow rules (transport rules) in Exchange Online are used to identify and take action on messages that flow through the organization.",
@@ -1633,7 +1710,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6.2",
+          "Section": "6 Exchange admin center",
+          "SubSection": "6.2 Mail Flow",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "External callouts provide a native experience to identify emails from senders outside the organization. This is achieved by presenting a new tag on emails called \"External\" (the string is localized based on the client language setting) and exposing related user interface at the top of the message reading view to see and verify the real sender's email address.Once this feature is enabled via PowerShell, it might take 24-48 hours for users to start seeing the External sender tag in email messages received from external sources (outside of your organization), providing their Outlook version supports it.The recommended state is `ExternalInOutlook` set to `Enabled` `True`**Note:** Mail flow rules are often used by Exchange administrators to accomplish the External email tagging by appending a tag to the front of a subject line. There are limitations to this outlined [here.](https://techcommunity.microsoft.com/t5/exchange-team-blog/native-external-sender-callouts-on-email-in-outlook/ba-p/2250098) The preferred method in the CIS Benchmark is to use the native experience.",
@@ -1655,7 +1733,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6.3",
+          "Section": "6 Exchange admin center",
+          "SubSection": "6.3 Roles",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Specify the administrators and users who can install and manage add-ins for Outlook in Exchange OnlineBy default, users can install add-ins in their Microsoft Outlook Desktop client, allowing data access within the client application.",
@@ -1677,7 +1756,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6.5",
+          "Section": "6 Exchange admin center",
+          "SubSection": "6.5 Settings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Modern authentication in Microsoft 365 enables authentication features like multifactor authentication (MFA) using smart cards, certificate-based authentication (CBA), and third-party SAML identity providers. When you enable modern authentication in Exchange Online, Outlook 2016 and Outlook 2013 use modern authentication to log in to Microsoft 365 mailboxes. When you disable modern authentication in Exchange Online, Outlook 2016 and Outlook 2013 use basic authentication to log in to Microsoft 365 mailboxes.When users initially configure certain email clients, like Outlook 2013 and Outlook 2016, they may be required to authenticate using enhanced authentication mechanisms, such as multifactor authentication. Other Outlook clients that are available in Microsoft 365 (for example, Outlook Mobile and Outlook for Mac 2016) always use modern authentication to log in to Microsoft 365 mailboxes.",
@@ -1699,7 +1779,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6.5",
+          "Section": "6 Exchange admin center",
+          "SubSection": "6.5 Settings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "MailTips are informative messages displayed to users while they're composing a message. While a new message is open and being composed, Exchange analyzes the message (including recipients). If a potential problem is detected, the user is notified with a MailTip prior to sending the message. Using the information in the MailTip, the user can adjust the message to avoid undesirable situations or non-delivery reports (also known as NDRs or bounce messages).",
@@ -1721,7 +1802,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6.5",
+          "Section": "6 Exchange admin center",
+          "SubSection": "6.5 Settings",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "This setting allows users to open certain external files while working in Outlook on the web. If allowed, keep in mind that ",
@@ -1743,7 +1825,8 @@
       ],
       "Attributes": [
         {
-          "Section": "6.5",
+          "Section": "6 Exchange admin center",
+          "SubSection": "6.5 Settings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "This setting enables or disables authenticated client SMTP submission (SMTP AUTH) at an organization level in Exchange Online. The recommended state is `Turn off SMTP AUTH protocol for your organization` (checked).",
@@ -1765,7 +1848,8 @@
       ],
       "Attributes": [
         {
-          "Section": "7.2",
+          "Section": "7 SharePoint admin center",
+          "SubSection": "7.2 Policies",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Modern authentication in Microsoft 365 enables authentication features like multifactor authentication (MFA) using smart cards, certificate-based authentication (CBA), and third-party SAML identity providers.",
@@ -1785,7 +1869,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "7.2",
+          "Section": "7 SharePoint admin center",
+          "SubSection": "7.2 Policies",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Entra ID B2B provides authentication and management of guests. Authentication happens via one-time passcode when they don't already have a work or school account or a Microsoft account. Integration with SharePoint and OneDrive allows for more granular control of how guest user accounts are managed in the organization's AAD, unifying a similar guest experience already deployed in other Microsoft 365 services such as Teams.**Note:** Global Reader role currently can't access SharePoint using PowerShell.",
@@ -1807,7 +1892,8 @@
       ],
       "Attributes": [
         {
-          "Section": "7.2",
+          "Section": "7 SharePoint admin center",
+          "SubSection": "7.2 Policies",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "The external sharing settings govern sharing for the organization overall. Each site has its own sharing setting that can be set independently, though it must be at the same or more restrictive setting as the organization. The new and existing guests option requires people who have received invitations to sign in with their work or school account (if their organization uses Microsoft 365) or a Microsoft account, or to provide a code to verify their identity. Users can share with guests already in your organization's directory, and they can send invitations to people who will be added to the directory if they sign in.The recommended state is `New and existing guests` or less permissive.",
@@ -1827,7 +1913,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "7.2",
+          "Section": "7 SharePoint admin center",
+          "SubSection": "7.2 Policies",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "This setting governs the global permissiveness of OneDrive content sharing in the organization. OneDrive content sharing can be restricted independent of SharePoint but can never be more permissive than the level established with SharePoint.The recommended state is `Only people in your organization`.",
@@ -1849,7 +1936,8 @@
       ],
       "Attributes": [
         {
-          "Section": "7.2",
+          "Section": "7 SharePoint admin center",
+          "SubSection": "7.2 Policies",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "SharePoint gives users the ability to share files, folders, and site collections. Internal users can share with external collaborators, and with the right permissions could share to other external parties.",
@@ -1871,7 +1959,8 @@
       ],
       "Attributes": [
         {
-          "Section": "7.2",
+          "Section": "7 SharePoint admin center",
+          "SubSection": "7.2 Policies",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Control sharing of documents to external domains by either blocking domains or only allowing sharing with specific named domains.",
@@ -1891,7 +1980,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "7.2",
+          "Section": "7 SharePoint admin center",
+          "SubSection": "7.2 Policies",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "This setting sets the default link type that a user will see when sharing content in OneDrive or SharePoint. It does not restrict or exclude any other options.The recommended state is `Specific people (only the people the user specifies)`",
@@ -1911,7 +2001,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "7.2",
+          "Section": "7 SharePoint admin center",
+          "SubSection": "7.2 Policies",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Manual",
           "Description": "External sharing of content can be restricted to specific security groups. This setting is global, applies to sharing in both SharePoint and OneDrive and cannot be set at the site level in SharePoint.The recommended state is `Enabled` or `Checked`.**Note:** Users in these security groups must be allowed to invite guests in the guest invite settings in Microsoft Entra. Identity > External Identities > External collaboration settings",
@@ -1931,7 +2022,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "7.2",
+          "Section": "7 SharePoint admin center",
+          "SubSection": "7.2 Policies",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "This policy setting configures the expiration time for each guest that is invited to the SharePoint site or with whom users share individual files and folders with.The recommended state is `30` or less.",
@@ -1951,7 +2043,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "7.2",
+          "Section": "7 SharePoint admin center",
+          "SubSection": "7.2 Policies",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "This setting configures if guests who use a verification code to access the site or links are required to reauthenticate after a set number of days.The recommended state is `15` or less.",
@@ -1971,7 +2064,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "7.2",
+          "Section": "7 SharePoint admin center",
+          "SubSection": "7.2 Policies",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "This setting configures the permission that is selected by default for sharing link from a SharePoint site.The recommended state is `View`.",
@@ -1991,7 +2085,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "7.3",
+          "Section": "7 SharePoint admin center",
+          "SubSection": "7.3 Settings",
           "Profile": "E5 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "By default, SharePoint online allows files that Defender for Office 365 has detected as infected to be downloaded.",
@@ -2013,7 +2108,8 @@
       ],
       "Attributes": [
         {
-          "Section": "7.3",
+          "Section": "7 SharePoint admin center",
+          "SubSection": "7.3 Settings",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Microsoft OneDrive allows users to sign in their cloud tenant account and begin syncing select folders or the entire contents of OneDrive to a local computer. By default, this includes any computer with OneDrive already installed, whether it is Entra Joined , Entra Hybrid Joined or Active Directory Domain joined.The recommended state for this setting is `Allow syncing only on computers joined to specific domains` `Enabled: Specify the AD domain GUID(s)`",
@@ -2033,7 +2129,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "7.3",
+          "Section": "7 SharePoint admin center",
+          "SubSection": "7.3 Settings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "This setting controls custom script execution on self-service created sites.Custom scripts can allow users to change the look, feel and behavior of sites and pages. Every script that runs in a SharePoint page (whether it's an HTML page in a document library or a JavaScript in a Script Editor Web Part) always runs in the context of the user visiting the page and the SharePoint application. This means:- Scripts have access to everything the user has access to.- Scripts can access content across several Microsoft 365 services and even beyond with Microsoft Graph integration.The recommended state is `Prevent users from running custom script on self-service created sites`.",
@@ -2053,7 +2150,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "7.3",
+          "Section": "7 SharePoint admin center",
+          "SubSection": "7.3 Settings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "This setting controls custom script execution on a particular site (previously called \"site collection\").Custom scripts can allow users to change the look, feel and behavior of sites and pages. Every script that runs in a SharePoint page (whether it's an HTML page in a document library or a JavaScript in a Script Editor Web Part) always runs in the context of the user visiting the page and the SharePoint application. This means:- Scripts have access to everything the user has access to.- Scripts can access content across several Microsoft 365 services and even beyond with Microsoft Graph integration.The recommended state is `DenyAddAndCustomizePages` set to `$true`.",
@@ -2075,7 +2173,8 @@
       ],
       "Attributes": [
         {
-          "Section": "8.1",
+          "Section": "8 Microsoft Teams admin center",
+          "SubSection": "8.1 Teams",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "Microsoft Teams enables collaboration via file sharing. This file sharing is conducted within Teams, using SharePoint Online, by default; however, third-party cloud services are allowed as well.**Note:** Skype for business is deprecated as of July 31, 2021 although these settings may still be valid for a period of time. See the link in the references section for more information.",
@@ -2097,7 +2196,8 @@
       ],
       "Attributes": [
         {
-          "Section": "8.1",
+          "Section": "8 Microsoft Teams admin center",
+          "SubSection": "8.1 Teams",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "Teams channel email addresses are an optional feature that allows users to email the Teams channel directly.",
@@ -2119,7 +2219,8 @@
       ],
       "Attributes": [
         {
-          "Section": "8.2",
+          "Section": "8 Microsoft Teams admin center",
+          "SubSection": "8.2 Users",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "This policy controls whether external domains are allowed, blocked or permitted based on an allowlist or denylist. When external domains are allowed, users in your organization can chat, add users to meetings, and use audio video conferencing with users in external organizations.The recommended state is `Allow only specific external domains` or `Block all external domains`.",
@@ -2141,7 +2242,8 @@
       ],
       "Attributes": [
         {
-          "Section": "8.2",
+          "Section": "8 Microsoft Teams admin center",
+          "SubSection": "8.2 Users",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "This policy setting controls chats and meetings with external unmanaged Teams users (those not managed by an organization, such as Microsoft Teams (free)). The recommended state is: `People in my organization can communicate with Teams users whose accounts aren't managed by an organization` set to `Off`.",
@@ -2163,7 +2265,8 @@
       ],
       "Attributes": [
         {
-          "Section": "8.2",
+          "Section": "8 Microsoft Teams admin center",
+          "SubSection": "8.2 Users",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "This setting prevents external users who are not managed by an organization from initiating contact with users in the protected organization.The recommended state is to uncheck `External users with Teams accounts not managed by an organization can contact users in my organization`.**Note:** Disabling this setting is used as an additional stop gap for the previous setting which disables communication with unmanaged Teams users entirely. If an organization chooses to have an exception to **(L1) Ensure communication with unmanaged Teams users is disabled** they can do so while also disabling the ability for the same group of users to initiate contact. Disabling communication entirely will also disable the ability for unmanaged users to initiate contact.",
@@ -2183,7 +2286,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "8.2",
+          "Section": "8 Microsoft Teams admin center",
+          "SubSection": "8.2 Users",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "This policy setting controls chat with external unmanaged Skype users.**Note:** Skype for business is deprecated as of July 31, 2021, although these settings may still be valid for a period of time. See the link in the reference section for more information.",
@@ -2203,7 +2307,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "8.4",
+          "Section": "8 Microsoft Teams admin center",
+          "SubSection": "8.4 Teams apps",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "This policy setting controls which class of apps are available for users to install.",
@@ -2225,7 +2330,8 @@
       ],
       "Attributes": [
         {
-          "Section": "8.5",
+          "Section": "8 Microsoft Teams admin center",
+          "SubSection": "8.5 Meetings",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "This policy setting can prevent anyone other than invited attendees (people directly invited by the organizer, or to whom an invitation was forwarded) from bypassing the lobby and entering the meeting.For more information on how to setup a sensitive meeting, please visit **Configure Teams meetings with protection for sensitive data - Microsoft Teams:** https://learn.microsoft.com/en-us/MicrosoftTeams/configure-meetings-sensitive-protection",
@@ -2247,7 +2353,8 @@
       ],
       "Attributes": [
         {
-          "Section": "8.5",
+          "Section": "8 Microsoft Teams admin center",
+          "SubSection": "8.5 Meetings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "This policy setting controls if an anonymous participant can start a Microsoft Teams meeting without someone in attendance. Anonymous users and dial-in callers must wait in the lobby until the meeting is started by someone in the organization or an external user from a trusted organization.Anonymous participants are classified as:- Participants who are not logged in to Teams with a work or school account.- Participants from non-trusted organizations (as configured in external access).- Participants from organizations where there is not mutual trust.**Note:** This setting only applies when `Who can bypass the lobby` is set to `Everyone`. If the `anonymous users can join a meeting` organization-level setting or meeting policy is `Off`, this setting only applies to dial-in callers.",
@@ -2269,7 +2376,8 @@
       ],
       "Attributes": [
         {
-          "Section": "8.5",
+          "Section": "8 Microsoft Teams admin center",
+          "SubSection": "8.5 Meetings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "This policy setting controls who can join a meeting directly and who must wait in the lobby until they're admitted by an organizer, co-organizer, or presenter of the meeting.",
@@ -2291,7 +2399,8 @@
       ],
       "Attributes": [
         {
-          "Section": "8.5",
+          "Section": "8 Microsoft Teams admin center",
+          "SubSection": "8.5 Meetings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "This policy setting controls if users who dial in by phone can join the meeting directly or must wait in the lobby. Admittance to the meeting from the lobby is authorized by the meeting organizer, co-organizer, or presenter of the meeting.",
@@ -2313,7 +2422,8 @@
       ],
       "Attributes": [
         {
-          "Section": "8.5",
+          "Section": "8 Microsoft Teams admin center",
+          "SubSection": "8.5 Meetings",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "This policy setting controls who has access to read and write chat messages during a meeting.",
@@ -2335,7 +2445,8 @@
       ],
       "Attributes": [
         {
-          "Section": "8.5",
+          "Section": "8 Microsoft Teams admin center",
+          "SubSection": "8.5 Meetings",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "This policy setting controls who can present in a Teams meeting. **Note:** Organizers and co-organizers can change this setting when the meeting is set up.",
@@ -2357,7 +2468,8 @@
       ],
       "Attributes": [
         {
-          "Section": "8.5",
+          "Section": "8 Microsoft Teams admin center",
+          "SubSection": "8.5 Meetings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "This policy setting allows control of who can present in meetings and who can request control of the presentation while a meeting is underway.",
@@ -2379,7 +2491,8 @@
       ],
       "Attributes": [
         {
-          "Section": "8.5",
+          "Section": "8 Microsoft Teams admin center",
+          "SubSection": "8.5 Meetings",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "This meeting policy setting controls whether users can read or write messages in external meeting chats with untrusted organizations. If an external organization is on the list of trusted organizations this setting will be ignored.",
@@ -2401,7 +2514,8 @@
       ],
       "Attributes": [
         {
-          "Section": "8.5",
+          "Section": "8 Microsoft Teams admin center",
+          "SubSection": "8.5 Meetings",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Automated",
           "Description": "This setting controls the ability for a user to initiate a recording of a meeting in progress.The recommended state is `Off` for the `Global (Org-wide default)` meeting policy.",
@@ -2424,7 +2538,8 @@
       ],
       "Attributes": [
         {
-          "Section": "8.6",
+          "Section": "8 Microsoft Teams admin center",
+          "SubSection": "8.6 Messaging",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Automated",
           "Description": "User reporting settings allow a user to report a message as malicious for further analysis. This recommendation is composed of 3 different settings and all be configured to pass:- **In the Teams admin center:** On by default and controls whether users are able to report messages from Teams. When this setting is turned off, users can't report messages within Teams, so the corresponding setting in the Microsoft 365 Defender portal is irrelevant.- **In the Microsoft 365 Defender portal:** On by default for new tenants. Existing tenants need to enable it. If user reporting of messages is turned on in the Teams admin center, it also needs to be turned on the Defender portal for user reported messages to show up correctly on the User reported tab on the Submissions page.- **Defender - Report message destinations:** This applies to more than just Microsoft Teams and allows for an organization to keep their reports contained. Due to how the parameters are configured on the backend it is included in this assessment as a requirement.",
@@ -2444,7 +2559,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "9.1",
+          "Section": "9 Microsoft Fabric",
+          "SubSection": "9.1 Teams settings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "This setting allows business-to-business (B2B) guests access to Microsoft Fabric, and contents that they have permissions to. With the setting turned off, B2B guest users receive an error when trying to access Power BI.The recommended state is `Enabled for a subset of the organization` or `Disabled`.",
@@ -2464,7 +2580,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "9.1",
+          "Section": "9 Microsoft Fabric",
+          "SubSection": "9.1 Teams settings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "This setting helps organizations choose whether new external users can be invited to the organization through Power BI sharing, permissions, and subscription experiences. This setting only controls the ability to invite through Power BI.The recommended state is `Enabled for a subset of the organization` or `Disabled`.**Note:** To invite external users to the organization, the user must also have the Microsoft Entra Guest Inviter role.",
@@ -2484,7 +2601,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "9.1",
+          "Section": "9 Microsoft Fabric",
+          "SubSection": "9.1 Teams settings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "This setting allows Microsoft Entra B2B guest users to have full access to the browsing experience using the left-hand navigation pane in the organization. Guest users who have been assigned workspace roles or specific item permissions will continue to have those roles and/or permissions, even if this setting is disabled.The recommended state is `Enabled for a subset of the organization` or `Disabled`.",
@@ -2504,7 +2622,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "9.1",
+          "Section": "9 Microsoft Fabric",
+          "SubSection": "9.1 Teams settings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Power BI enables users to share reports and materials directly on the internet from both the application's desktop version and its web user interface. This functionality generates a publicly reachable web link that doesn't necessitate authentication or the need to be an Entra ID user in order to access and view it.The recommended state is `Enabled for a subset of the organization` or `Disabled`.",
@@ -2524,7 +2643,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "9.1",
+          "Section": "9 Microsoft Fabric",
+          "SubSection": "9.1 Teams settings",
           "Profile": "E3 Level 2",
           "AssessmentStatus": "Manual",
           "Description": "Power BI allows the integration of R and Python scripts directly into visuals. This feature allows data visualizations by incorporating custom calculations, statistical analyses, machine learning models, and more using R or Python scripts. Custom visuals can be created by embedding them directly into Power BI reports. Users can then interact with these visuals and see the results of the custom code within the Power BI interface.",
@@ -2544,7 +2664,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "9.1",
+          "Section": "9 Microsoft Fabric",
+          "SubSection": "9.1 Teams settings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Information protection tenant settings help to protect sensitive information in the Power BI tenant. Allowing and applying sensitivity labels to content ensures that information is only seen and accessed by the appropriate users.The recommended state is `Enabled` or `Enabled for a subset of the organization`.**Note:** Sensitivity labels and protection are only applied to files exported to Excel, PowerPoint, or PDF files, that are controlled by \"Export to Excel\" and \"Export reports as PowerPoint presentation or PDF documents\" settings. All other export and sharing options do not support the application of sensitivity labels and protection.**Note 2:** There are some prerequisite steps that need to be completed in order to fully utilize labeling. See [here](https://learn.microsoft.com/en-us/power-bi/enterprise/service-security-enable-data-sensitivity-labels#licensing-and-requirements).",
@@ -2564,7 +2685,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "9.1",
+          "Section": "9 Microsoft Fabric",
+          "SubSection": "9.1 Teams settings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Creating a shareable link allows a user to create a link to a report or dashboard, then add that link to an email or another messaging application. There are 3 options that can be selected when creating a shareable link:- People in your organization- People with existing access- Specific peopleThis setting solely deals with restrictions to `People in the organization`. External users by default are not included in any of these categories, and therefore cannot use any of these links regardless of the state of this setting.The recommended state is `Enabled for a subset of the organization` or `Disabled`.",
@@ -2584,7 +2706,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "9.1",
+          "Section": "9 Microsoft Fabric",
+          "SubSection": "9.1 Teams settings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Power BI admins can specify which users or user groups can share datasets externally with guests from a different tenant through the in-place mechanism. Disabling this setting prevents any user from sharing datasets externally by restricting the ability of users to turn on external sharing for datasets they own or manage.The recommended state is `Enabled for a subset of the organization` or `Disabled`.",
@@ -2604,7 +2727,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "9.1",
+          "Section": "9 Microsoft Fabric",
+          "SubSection": "9.1 Teams settings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "This setting blocks the use of resource key based authentication. The Block ResourceKey Authentication setting applies to streaming and PUSH datasets. If blocked users will not be allowed send data to streaming and PUSH datasets using the API with a resource key.The recommended state is `Enabled`.",
@@ -2624,7 +2748,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "9.1",
+          "Section": "9 Microsoft Fabric",
+          "SubSection": "9.1 Teams settings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Web apps registered in Microsoft Entra ID use an assigned service principal to access Power BI APIs without a signed-in user. This setting allows an app to use service principal authentication.The recommended state is `Enabled for a subset of the organization` or `Disabled`.",
@@ -2644,7 +2769,8 @@
       "Checks": [],
       "Attributes": [
         {
-          "Section": "9.1",
+          "Section": "9 Microsoft Fabric",
+          "SubSection": "9.1 Teams settings",
           "Profile": "E3 Level 1",
           "AssessmentStatus": "Manual",
           "Description": "Service principal profiles provide a flexible solution for apps used in a multitenancy deployment. The profiles enable customer data isolation and tighter security boundaries between customers that are utilizing the app.The recommended state is `Enabled for a subset of the organization` or `Disabled`.",
diff --git a/prowler/lib/check/models.py b/prowler/lib/check/models.py
index 5e240f74cc..0ef3195b2a 100644
--- a/prowler/lib/check/models.py
+++ b/prowler/lib/check/models.py
@@ -556,7 +556,7 @@ class CheckReportGithub(Check_Report):
         resource: Any,
         resource_name: str = None,
         resource_id: str = None,
-        repository: str = None,
+        repository: str = "global",
     ) -> None:
         """Initialize the GitHub Check's finding information.
 
diff --git a/prowler/lib/cli/parser.py b/prowler/lib/cli/parser.py
index f2cc8d12dd..1990c7f90a 100644
--- a/prowler/lib/cli/parser.py
+++ b/prowler/lib/cli/parser.py
@@ -34,6 +34,7 @@ Available Cloud Providers:
     azure               Azure Provider
     gcp                 GCP Provider
     kubernetes          Kubernetes Provider
+    github              GitHub Provider
     m365                Microsoft 365 Provider
     nhn                 NHN Provider (Unofficial)
 
diff --git a/prowler/lib/outputs/compliance/cis/cis_github.py b/prowler/lib/outputs/compliance/cis/cis_github.py
new file mode 100644
index 0000000000..c06a766a05
--- /dev/null
+++ b/prowler/lib/outputs/compliance/cis/cis_github.py
@@ -0,0 +1,101 @@
+from datetime import datetime
+
+from prowler.lib.check.compliance_models import Compliance
+from prowler.lib.outputs.compliance.cis.models import GithubCISModel
+from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
+from prowler.lib.outputs.finding import Finding
+
+
+class GithubCIS(ComplianceOutput):
+    """
+    This class represents the GitHub CIS compliance output.
+
+    Attributes:
+        - _data (list): A list to store transformed data from findings.
+        - _file_descriptor (TextIOWrapper): A file descriptor to write data to a file.
+
+    Methods:
+        - transform: Transforms findings into GitHub CIS compliance format.
+    """
+
+    def transform(
+        self,
+        findings: list[Finding],
+        compliance: Compliance,
+        compliance_name: str,
+    ) -> None:
+        """
+        Transforms a list of findings into GitHub CIS compliance format.
+
+        Parameters:
+            - findings (list): A list of findings.
+            - compliance (Compliance): A compliance model.
+            - compliance_name (str): The name of the compliance model.
+
+        Returns:
+            - None
+        """
+        for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
+            for requirement in compliance.Requirements:
+                if requirement.Id in finding_requirements:
+                    for attribute in requirement.Attributes:
+                        compliance_row = GithubCISModel(
+                            Provider=finding.provider,
+                            Description=compliance.Description,
+                            Account_Id=finding.account_uid,
+                            Account_Name=finding.account_name,
+                            AssessmentDate=str(finding.timestamp),
+                            Requirements_Id=requirement.Id,
+                            Requirements_Description=requirement.Description,
+                            Requirements_Attributes_Section=attribute.Section,
+                            Requirements_Attributes_Profile=attribute.Profile,
+                            Requirements_Attributes_AssessmentStatus=attribute.AssessmentStatus,
+                            Requirements_Attributes_Description=attribute.Description,
+                            Requirements_Attributes_RationaleStatement=attribute.RationaleStatement,
+                            Requirements_Attributes_ImpactStatement=attribute.ImpactStatement,
+                            Requirements_Attributes_RemediationProcedure=attribute.RemediationProcedure,
+                            Requirements_Attributes_AuditProcedure=attribute.AuditProcedure,
+                            Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
+                            Requirements_Attributes_References=attribute.References,
+                            Requirements_Attributes_DefaultValue=attribute.DefaultValue,
+                            Status=finding.status,
+                            StatusExtended=finding.status_extended,
+                            ResourceId=finding.resource_uid,
+                            ResourceName=finding.resource_name,
+                            CheckId=finding.check_id,
+                            Muted=finding.muted,
+                        )
+                        self._data.append(compliance_row)
+        # Add manual requirements to the compliance output
+        for requirement in compliance.Requirements:
+            if not requirement.Checks:
+                for attribute in requirement.Attributes:
+                    compliance_row = GithubCISModel(
+                        Provider=compliance.Provider.lower(),
+                        Description=compliance.Description,
+                        Account_Id="",
+                        Account_Name="",
+                        AssessmentDate=str(datetime.now()),
+                        Requirements_Id=requirement.Id,
+                        Requirements_Description=requirement.Description,
+                        Requirements_Attributes_Section=attribute.Section,
+                        Requirements_Attributes_Profile=attribute.Profile,
+                        Requirements_Attributes_AssessmentStatus=attribute.AssessmentStatus,
+                        Requirements_Attributes_Description=attribute.Description,
+                        Requirements_Attributes_RationaleStatement=attribute.RationaleStatement,
+                        Requirements_Attributes_ImpactStatement=attribute.ImpactStatement,
+                        Requirements_Attributes_RemediationProcedure=attribute.RemediationProcedure,
+                        Requirements_Attributes_AuditProcedure=attribute.AuditProcedure,
+                        Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
+                        Requirements_Attributes_References=attribute.References,
+                        Requirements_Attributes_DefaultValue=attribute.DefaultValue,
+                        Status="MANUAL",
+                        StatusExtended="Manual check",
+                        ResourceId="manual_check",
+                        ResourceName="Manual check",
+                        CheckId="manual",
+                        Muted=False,
+                    )
+                    self._data.append(compliance_row)
diff --git a/prowler/lib/outputs/compliance/cis/cis_m365.py b/prowler/lib/outputs/compliance/cis/cis_m365.py
index a587d98214..addc78a104 100644
--- a/prowler/lib/outputs/compliance/cis/cis_m365.py
+++ b/prowler/lib/outputs/compliance/cis/cis_m365.py
@@ -48,6 +48,7 @@ class M365CIS(ComplianceOutput):
                             Requirements_Id=requirement.Id,
                             Requirements_Description=requirement.Description,
                             Requirements_Attributes_Section=attribute.Section,
+                            Requirements_Attributes_SubSection=attribute.SubSection,
                             Requirements_Attributes_Profile=attribute.Profile,
                             Requirements_Attributes_AssessmentStatus=attribute.AssessmentStatus,
                             Requirements_Attributes_Description=attribute.Description,
@@ -79,6 +80,7 @@ class M365CIS(ComplianceOutput):
                         Requirements_Id=requirement.Id,
                         Requirements_Description=requirement.Description,
                         Requirements_Attributes_Section=attribute.Section,
+                        Requirements_Attributes_SubSection=attribute.SubSection,
                         Requirements_Attributes_Profile=attribute.Profile,
                         Requirements_Attributes_AssessmentStatus=attribute.AssessmentStatus,
                         Requirements_Attributes_Description=attribute.Description,
diff --git a/prowler/lib/outputs/compliance/cis/models.py b/prowler/lib/outputs/compliance/cis/models.py
index 201925f19d..1a4764c294 100644
--- a/prowler/lib/outputs/compliance/cis/models.py
+++ b/prowler/lib/outputs/compliance/cis/models.py
@@ -82,6 +82,7 @@ class M365CISModel(BaseModel):
     Requirements_Id: str
     Requirements_Description: str
     Requirements_Attributes_Section: str
+    Requirements_Attributes_SubSection: Optional[str]
     Requirements_Attributes_Profile: str
     Requirements_Attributes_AssessmentStatus: str
     Requirements_Attributes_Description: str
@@ -163,6 +164,37 @@ class KubernetesCISModel(BaseModel):
     Muted: bool
 
 
+class GithubCISModel(BaseModel):
+    """
+    GithubCISModel generates a finding's output in Github CIS Compliance format.
+    """
+
+    Provider: str
+    Description: str
+    Account_Name: str
+    Account_Id: str
+    AssessmentDate: str
+    Requirements_Id: str
+    Requirements_Description: str
+    Requirements_Attributes_Section: str
+    Requirements_Attributes_Profile: str
+    Requirements_Attributes_AssessmentStatus: str
+    Requirements_Attributes_Description: str
+    Requirements_Attributes_RationaleStatement: str
+    Requirements_Attributes_ImpactStatement: str
+    Requirements_Attributes_RemediationProcedure: str
+    Requirements_Attributes_AuditProcedure: str
+    Requirements_Attributes_AdditionalInformation: str
+    Requirements_Attributes_References: str
+    Requirements_Attributes_DefaultValue: str
+    Status: str
+    StatusExtended: str
+    ResourceId: str
+    ResourceName: str
+    CheckId: str
+    Muted: bool
+
+
 # TODO: Create a parent class for the common fields of CIS and have the specific classes from each provider to inherit from it.
 # It is not done yet because it is needed to respect the current order of the fields in the output file.
 
diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.metadata.json
index c0dfb55761..6b295afc6d 100644
--- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.metadata.json
+++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.metadata.json
@@ -8,7 +8,7 @@
   "ServiceName": "ec2",
   "SubServiceName": "securitygroup",
   "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
-  "Severity": "high",
+  "Severity": "critical",
   "ResourceType": "AwsEc2SecurityGroup",
   "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to all ports.",
   "Risk": "If Security groups are not properly configured the attack surface is increased. An attacker could exploit this misconfiguration to gain unauthorized access to resources.",
diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.py
index 943cc9b9d0..e9e7d47609 100644
--- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.py
+++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.py
@@ -1,4 +1,4 @@
-from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.lib.check.models import Check, Check_Report_AWS, Severity
 from prowler.providers.aws.services.ec2.ec2_client import ec2_client
 from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
 from prowler.providers.aws.services.vpc.vpc_client import vpc_client
@@ -9,14 +9,17 @@ class ec2_securitygroup_allow_ingress_from_internet_to_all_ports(Check):
         findings = []
         for security_group_arn, security_group in ec2_client.security_groups.items():
             # Check if ignoring flag is set and if the VPC and the SG is in use
-            if ec2_client.provider.scan_unused_services or (
+            sg_in_use = (
                 security_group.vpc_id in vpc_client.vpcs
                 and vpc_client.vpcs[security_group.vpc_id].in_use
                 and len(security_group.network_interfaces) > 0
-            ):
+            )
+            if ec2_client.provider.scan_unused_services or sg_in_use:
                 report = Check_Report_AWS(
                     metadata=self.metadata(), resource=security_group
                 )
+                if not sg_in_use:
+                    report.check_metadata.Severity = Severity.high
                 report.resource_details = security_group.name
                 report.status = "PASS"
                 report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have all ports open to the Internet."
diff --git a/prowler/providers/aws/services/efs/efs_multi_az_enabled/__int__.py b/prowler/providers/aws/services/efs/efs_multi_az_enabled/__init__.py
similarity index 100%
rename from prowler/providers/aws/services/efs/efs_multi_az_enabled/__int__.py
rename to prowler/providers/aws/services/efs/efs_multi_az_enabled/__init__.py
diff --git a/prowler/providers/aws/services/iam/lib/policy.py b/prowler/providers/aws/services/iam/lib/policy.py
index b45dd1bd30..e023b137b5 100644
--- a/prowler/providers/aws/services/iam/lib/policy.py
+++ b/prowler/providers/aws/services/iam/lib/policy.py
@@ -1,4 +1,5 @@
 from ipaddress import ip_address, ip_network
+import re
 
 from prowler.lib.logger import logger
 from prowler.providers.aws.aws_provider import read_aws_regions_file
@@ -415,6 +416,55 @@ def is_condition_block_restrictive_organization(
     return is_condition_valid
 
 
+def is_condition_block_restrictive_sns_endpoint(
+    condition_statement: dict,
+):
+    """
+    is_condition_block_restrictive_sns_endpoint parses the IAM Condition policy block and returns True if the condition_statement is restrictive for an endpoint, False if not.
+
+    @param condition_statement: dict with an IAM Condition block, e.g.:
+        {
+            "StringLike": {
+                "SNS:Endpoint": "https://events.pagerduty.com/integration//enqueue"
+            }
+        }
+
+    """
+    is_condition_valid = False
+
+    # The conditions must be defined in lowercase since the context key names are not case-sensitive.
+    # For example, including the aws:PrincipalOrgID context key is equivalent to testing for AWS:PrincipalOrgID
+    # https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html
+    valid_condition_options = {
+        "StringEquals": [
+            "sns:endpoint",
+        ],
+        "StringLike": [
+            "sns:endpoint",
+        ],
+    }
+
+    for condition_operator, condition_operator_key in valid_condition_options.items():
+        if condition_operator in condition_statement:
+            # https://docs.aws.amazon.com/sns/latest/dg/sns-using-identity-based-policies.html#sns-policy-keys
+            # sns:endpoint - The URL, email address, or ARN from a Subscribe request or a previously confirmed subscription.
+            pattern = re.compile(r".+@[^*]+|^https:\/\/[^*]+|^arn:aws:sns:[^*]+")
+            for value in condition_operator_key:
+                # We need to transform the condition_statement into lowercase
+                condition_statement[condition_operator] = {
+                    k.lower(): v
+                    for k, v in condition_statement[condition_operator].items()
+                }
+
+                if value in condition_statement[condition_operator]:
+                    if pattern.fullmatch(
+                        condition_statement[condition_operator][value]
+                    ):
+                        is_condition_valid = True
+
+    return is_condition_valid
+
+
 def process_actions(effect, actions, target_set):
     """
     process_actions processes the actions in the policy.
diff --git a/prowler/providers/aws/services/opensearch/opensearch_service_domains_access_control_enabled/__init__.py b/prowler/providers/aws/services/opensearch/opensearch_service_domains_access_control_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.py b/prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.py
index 536bf4f800..1dc0776b64 100644
--- a/prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.py
+++ b/prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.py
@@ -2,6 +2,7 @@ from prowler.lib.check.models import Check, Check_Report_AWS
 from prowler.providers.aws.services.iam.lib.policy import (
     is_condition_block_restrictive,
     is_condition_block_restrictive_organization,
+    is_condition_block_restrictive_sns_endpoint,
 )
 from prowler.providers.aws.services.sns.sns_client import sns_client
 
@@ -32,6 +33,7 @@ class sns_topics_not_publicly_accessible(Check):
                         ):
                             condition_account = False
                             condition_org = False
+                            condition_endpoint = False
                             if (
                                 "Condition" in statement
                                 and is_condition_block_restrictive(
@@ -47,6 +49,13 @@ class sns_topics_not_publicly_accessible(Check):
                                 )
                             ):
                                 condition_org = True
+                            if (
+                                "Condition" in statement
+                                and is_condition_block_restrictive_sns_endpoint(
+                                    statement["Condition"],
+                                )
+                            ):
+                                condition_endpoint = True
 
                             if condition_account and condition_org:
                                 report.status_extended = f"SNS topic {topic.name} is not public because its policy only allows access from the account {sns_client.audited_account} and an organization."
@@ -54,6 +63,8 @@ class sns_topics_not_publicly_accessible(Check):
                                 report.status_extended = f"SNS topic {topic.name} is not public because its policy only allows access from the account {sns_client.audited_account}."
                             elif condition_org:
                                 report.status_extended = f"SNS topic {topic.name} is not public because its policy only allows access from an organization."
+                            elif condition_endpoint:
+                                report.status_extended = f"SNS topic {topic.name} is not public because its policy only allows access from an endpoint."
                             else:
                                 report.status = "FAIL"
                                 report.status_extended = f"SNS topic {topic.name} is public because its policy allows public access."
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_use_aad_and_rbac/__init__.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_use_aad_and_rbac/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/keyvault/keyvault_key_rotation_enabled/__init__.py b/prowler/providers/azure/services/keyvault/keyvault_key_rotation_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/github/github_provider.py b/prowler/providers/github/github_provider.py
index 000f0e40d5..d34b2b3e66 100644
--- a/prowler/providers/github/github_provider.py
+++ b/prowler/providers/github/github_provider.py
@@ -247,7 +247,7 @@ class GithubProvider(Provider):
                 if not session_token:
                     # OAUTH
                     logger.info(
-                        "Looking for GITHUB_OAUTH_TOKEN environment variable as user has not provided any token...."
+                        "Looking for GITHUB_OAUTH_APP_TOKEN environment variable as user has not provided any token...."
                     )
                     session_token = environ.get("GITHUB_OAUTH_APP_TOKEN", "")
                     if session_token:
diff --git a/prowler/providers/github/services/organization/__init__.py b/prowler/providers/github/services/organization/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/github/services/organization/organization_client.py b/prowler/providers/github/services/organization/organization_client.py
new file mode 100644
index 0000000000..8c05c87178
--- /dev/null
+++ b/prowler/providers/github/services/organization/organization_client.py
@@ -0,0 +1,6 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.github.services.organization.organization_service import (
+    Organization,
+)
+
+organization_client = Organization(Provider.get_global_provider())
diff --git a/prowler/providers/github/services/organization/organization_members_mfa_required/__init__.py b/prowler/providers/github/services/organization/organization_members_mfa_required/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/github/services/organization/organization_members_mfa_required/organization_members_mfa_required.metadata.json b/prowler/providers/github/services/organization/organization_members_mfa_required/organization_members_mfa_required.metadata.json
new file mode 100644
index 0000000000..cb1d67e96e
--- /dev/null
+++ b/prowler/providers/github/services/organization/organization_members_mfa_required/organization_members_mfa_required.metadata.json
@@ -0,0 +1,30 @@
+{
+  "Provider": "github",
+  "CheckID": "organization_members_mfa_required",
+  "CheckTitle": "Check if organization members are required to have MFA enabled.",
+  "CheckType": [],
+  "ServiceName": "organization",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "critical",
+  "ResourceType": "GitHubOrganization",
+  "Description": "Ensure that all organization members are required to have multi-factor authentication (MFA) enabled. Enforcing MFA for all organization members helps protect the organization's resources and data from unauthorized access and security breaches.",
+  "Risk": "Without Multi-Factor Authentication (MFA), user accounts are vulnerable to unauthorized access if their passwords are compromised. This can lead to unauthorized actions such as data theft, malicious code commits, and repository manipulation, potentially compromising the organization's source code and intellectual property.",
+  "RelatedUrl": "https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Mandate the use of MFA for all organization members. This significantly enhances account security by adding an additional layer of protection beyond a username and password. MFA ensures that even if a password is compromised, unauthorized access to user accounts and repositories is prevented, safeguarding sensitive data and critical assets.",
+      "Url": "https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/preparing-to-require-two-factor-authentication-in-your-organization"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/github/services/organization/organization_members_mfa_required/organization_members_mfa_required.py b/prowler/providers/github/services/organization/organization_members_mfa_required/organization_members_mfa_required.py
new file mode 100644
index 0000000000..e18c127c0d
--- /dev/null
+++ b/prowler/providers/github/services/organization/organization_members_mfa_required/organization_members_mfa_required.py
@@ -0,0 +1,36 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportGithub
+from prowler.providers.github.services.organization.organization_client import (
+    organization_client,
+)
+
+
+class organization_members_mfa_required(Check):
+    """Check if organization members are required to have two-factor authentication enabled.
+
+    This class verifies whether each organization requires its members to have two-factor authentication enabled.
+    """
+
+    def execute(self) -> List[CheckReportGithub]:
+        """Execute the Github Organization Members MFA Required check.
+
+        Iterates over all organizations and checks if members are required to have two-factor authentication enabled.
+
+        Returns:
+            List[CheckReportGithub]: A list of reports for each repository
+        """
+        findings = []
+        for org in organization_client.organizations.values():
+            if org.mfa_required is not None:
+                report = CheckReportGithub(metadata=self.metadata(), resource=org)
+                report.status = "FAIL"
+                report.status_extended = f"Organization {org.name} does not require members to have two-factor authentication enabled."
+
+                if org.mfa_required:
+                    report.status = "PASS"
+                    report.status_extended = f"Organization {org.name} does require members to have two-factor authentication enabled."
+
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/github/services/organization/organization_service.py b/prowler/providers/github/services/organization/organization_service.py
new file mode 100644
index 0000000000..3f8f8dca95
--- /dev/null
+++ b/prowler/providers/github/services/organization/organization_service.py
@@ -0,0 +1,44 @@
+from typing import Optional
+
+from pydantic import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.github.lib.service.service import GithubService
+
+
+class Organization(GithubService):
+    def __init__(self, provider):
+        super().__init__(__class__.__name__, provider)
+        self.organizations = self._list_organizations()
+
+    def _list_organizations(self):
+        logger.info("Organization - Listing Organizations...")
+        organizations = {}
+        try:
+            for client in self.clients:
+                for org in client.get_user().get_orgs():
+                    try:
+                        require_mfa = org.two_factor_requirement_enabled
+                    except Exception as error:
+                        require_mfa = None
+                        logger.error(
+                            f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                        )
+                    organizations[org.id] = Org(
+                        id=org.id,
+                        name=org.login,
+                        mfa_required=require_mfa,
+                    )
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+        return organizations
+
+
+class Org(BaseModel):
+    """Model for Github Organization"""
+
+    id: int
+    name: str
+    mfa_required: Optional[bool] = False
diff --git a/prowler/providers/github/services/repository/repository_branch_delete_on_merge_enabled/__init__.py b/prowler/providers/github/services/repository/repository_branch_delete_on_merge_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled.metadata.json b/prowler/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled.metadata.json
new file mode 100644
index 0000000000..d5cff9a106
--- /dev/null
+++ b/prowler/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled.metadata.json
@@ -0,0 +1,30 @@
+{
+  "Provider": "github",
+  "CheckID": "repository_branch_delete_on_merge_enabled",
+  "CheckTitle": "Check if a repository deletes the branch after merging",
+  "CheckType": [],
+  "ServiceName": "repository",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "GitHubRepository",
+  "Description": "Ensure that the repository deletes the branch after merging.",
+  "Risk": "Inactive branches pose a security risk as they can accumulate outdated code, dependencies, and potential vulnerabilities over time. Malicious actors may exploit these branches, and they can clutter the repository, making it harder to manage and track the active code. Additionally, stale branches may unintentionally be accessed or used inappropriately, leading to potential security breaches.",
+  "RelatedUrl": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Regularly review and remove inactive branches from your repositories. This helps reduce the risk of malicious code injection, sensitive data leaks, and unnecessary clutter in the repository. By keeping branches active and up to date, you ensure that your codebase remains secure and manageable.",
+      "Url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-the-automatic-deletion-of-branches"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled.py b/prowler/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled.py
new file mode 100644
index 0000000000..5b561927c3
--- /dev/null
+++ b/prowler/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled.py
@@ -0,0 +1,41 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportGithub
+from prowler.providers.github.services.repository.repository_client import (
+    repository_client,
+)
+
+
+class repository_branch_delete_on_merge_enabled(Check):
+    """Check if a repository deletes branches on merge
+
+    This class verifies whether each repository deletes branches on merge.
+    """
+
+    def execute(self) -> List[CheckReportGithub]:
+        """Execute the Github Repository Deletes Branch On Merge check
+
+        Iterates over all repositories and checks if they delete branches on merge.
+
+        Returns:
+            List[CheckReportGithub]: A list of reports for each repository
+        """
+        findings = []
+        for repo in repository_client.repositories.values():
+            report = CheckReportGithub(
+                metadata=self.metadata(), resource=repo, repository=repo.name
+            )
+            report.status = "FAIL"
+            report.status_extended = (
+                f"Repository {repo.name} does not delete branches on merge."
+            )
+
+            if repo.delete_branch_on_merge:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Repository {repo.name} does delete branches on merge."
+                )
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/github/services/repository/repository_default_branch_deletion_disabled/__init__.py b/prowler/providers/github/services/repository/repository_default_branch_deletion_disabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled.metadata.json b/prowler/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled.metadata.json
new file mode 100644
index 0000000000..422ff6dbe4
--- /dev/null
+++ b/prowler/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled.metadata.json
@@ -0,0 +1,30 @@
+{
+  "Provider": "github",
+  "CheckID": "repository_default_branch_deletion_disabled",
+  "CheckTitle": "Check if a repository denies default branch deletion",
+  "CheckType": [],
+  "ServiceName": "repository",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "GitHubRepository",
+  "Description": "Ensure that the repository denies default branch deletion.",
+  "Risk": "Allowing the deletion of protected branches by users with push access increases the risk of accidental or intentional branch removal, potentially resulting in significant data loss or disruption to the development process.",
+  "RelatedUrl": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#allow-deletions",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Deny the ability to delete protected branches to ensure the preservation of critical branch data. This prevents accidental or malicious deletions and helps maintain the integrity and stability of the repository.",
+      "Url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled.py b/prowler/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled.py
new file mode 100644
index 0000000000..12d504a926
--- /dev/null
+++ b/prowler/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled.py
@@ -0,0 +1,42 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportGithub
+from prowler.providers.github.services.repository.repository_client import (
+    repository_client,
+)
+
+
+class repository_default_branch_deletion_disabled(Check):
+    """Check if a repository denies branch deletion
+
+    This class verifies whether each repository denies default branch deletion.
+    """
+
+    def execute(self) -> List[CheckReportGithub]:
+        """Execute the Github Repository Denies Default Branch Deletion check
+
+        Iterates over all repositories and checks if they deny default branch deletion.
+
+        Returns:
+            List[CheckReportGithub]: A list of reports for each repository
+        """
+        findings = []
+        for repo in repository_client.repositories.values():
+            if repo.default_branch_deletion is not None:
+                report = CheckReportGithub(
+                    metadata=self.metadata(), resource=repo, repository=repo.name
+                )
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Repository {repo.name} does allow default branch deletion."
+                )
+
+                if not repo.default_branch_deletion:
+                    report.status = "PASS"
+                    report.status_extended = (
+                        f"Repository {repo.name} does deny default branch deletion."
+                    )
+
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/__init__.py b/prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push.metadata.json b/prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push.metadata.json
new file mode 100644
index 0000000000..5cff05ec13
--- /dev/null
+++ b/prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push.metadata.json
@@ -0,0 +1,30 @@
+{
+  "Provider": "github",
+  "CheckID": "repository_default_branch_disallows_force_push",
+  "CheckTitle": "Check if repository denies force push",
+  "CheckType": [],
+  "ServiceName": "repository",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "GithubRepository",
+  "Description": "Ensure that the repository denies force push to protected branches.",
+  "Risk": "Permitting force pushes to branches can lead to accidental or intentional overwrites of the commit history, resulting in potential data loss, code inconsistencies, or the introduction of malicious changes. This compromises the stability and security of the repository.",
+  "RelatedUrl": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#allow-force-pushes",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Disable force pushes on protected branches to preserve the commit history and ensure the integrity of the repository. This measure helps prevent unintentional data loss and protects the repository from malicious changes.",
+      "Url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push.py b/prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push.py
new file mode 100644
index 0000000000..2183b84a79
--- /dev/null
+++ b/prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push.py
@@ -0,0 +1,42 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportGithub
+from prowler.providers.github.services.repository.repository_client import (
+    repository_client,
+)
+
+
+class repository_default_branch_disallows_force_push(Check):
+    """Check if a repository denies force push
+
+    This class verifies whether each repository denies force push.
+    """
+
+    def execute(self) -> List[CheckReportGithub]:
+        """Execute the Github Repository Denies Force Push check
+
+        Iterates over all repositories and checks if they deny force push.
+
+        Returns:
+            List[CheckReportGithub]: A list of reports for each repository
+        """
+        findings = []
+        for repo in repository_client.repositories.values():
+            if repo.allow_force_pushes is not None:
+                report = CheckReportGithub(
+                    metadata=self.metadata(), resource=repo, repository=repo.name
+                )
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Repository {repo.name} does allow force push."
+                )
+
+                if not repo.allow_force_pushes:
+                    report.status = "PASS"
+                    report.status_extended = (
+                        f"Repository {repo.name} does deny force push."
+                    )
+
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/__init__.py b/prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins.metadata.json b/prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins.metadata.json
new file mode 100644
index 0000000000..a20ff5f930
--- /dev/null
+++ b/prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins.metadata.json
@@ -0,0 +1,30 @@
+{
+  "Provider": "github",
+  "CheckID": "repository_default_branch_protection_applies_to_admins",
+  "CheckTitle": "Check if repository enforces admin branch protection",
+  "CheckType": [],
+  "ServiceName": "repository",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "GithubRepository",
+  "Description": "Ensure that the repository enforces branch protection rules for administrators.",
+  "Risk": "Excluding administrators from branch protection rules introduces a significant risk of unauthorized or unreviewed changes being pushed to protected branches. This can lead to vulnerabilities, including the potential insertion of malicious code, especially if an administrator account is compromised.",
+  "RelatedUrl": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#do-not-allow-bypassing-the-above-settings",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enforce branch protection rules for administrators to ensure they adhere to the same security and quality standards as other users. This mitigates the risk of unreviewed or untrusted code being introduced, enhancing the overall integrity of the codebase.",
+      "Url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins.py b/prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins.py
new file mode 100644
index 0000000000..916ddd35c5
--- /dev/null
+++ b/prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins.py
@@ -0,0 +1,38 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportGithub
+from prowler.providers.github.services.repository.repository_client import (
+    repository_client,
+)
+
+
+class repository_default_branch_protection_applies_to_admins(Check):
+    """Check if a repository enforces administrators to be subject to the same branch protection rules as other users
+
+    This class verifies whether each repository enforces administrators to be subject to the same branch protection rules as other users.
+    """
+
+    def execute(self) -> List[CheckReportGithub]:
+        """Execute the Github Repository Enforces Admin Branch Protection check
+
+        Iterates over all repositories and checks if they enforce administrators to be subject to the same branch protection rules as other users.
+
+        Returns:
+            List[CheckReportGithub]: A list of reports for each repository.
+        """
+        findings = []
+        for repo in repository_client.repositories.values():
+            if repo.enforce_admins is not None:
+                report = CheckReportGithub(
+                    metadata=self.metadata(), resource=repo, repository=repo.name
+                )
+                report.status = "FAIL"
+                report.status_extended = f"Repository {repo.name} does not enforce administrators to be subject to the same branch protection rules as other users."
+
+                if repo.enforce_admins:
+                    report.status = "PASS"
+                    report.status_extended = f"Repository {repo.name} does enforce administrators to be subject to the same branch protection rules as other users."
+
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/github/services/repository/repository_default_branch_protection_enabled/__init__.py b/prowler/providers/github/services/repository/repository_default_branch_protection_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled.metadata.json b/prowler/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled.metadata.json
new file mode 100644
index 0000000000..8ba7caa87a
--- /dev/null
+++ b/prowler/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled.metadata.json
@@ -0,0 +1,30 @@
+{
+  "Provider": "github",
+  "CheckID": "repository_default_branch_protection_enabled",
+  "CheckTitle": "Check if branch protection is enforced on the default branch ",
+  "CheckType": [],
+  "ServiceName": "repository",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "github:user-id:repository/repository-name",
+  "Severity": "critical",
+  "ResourceType": "GitHubRepository",
+  "Description": "Ensure branch protection is enforced on the default branch",
+  "Risk": "The absence of branch protection on the default branch increases the risk of unauthorized, unreviewed, or untested changes being merged. This can compromise the stability, security, and reliability of the codebase, which is especially critical for production deployments.",
+  "RelatedUrl": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Apply branch protection rules to the default branch to ensure it is safeguarded against unauthorized or improper modifications. This helps maintain code quality, enforces proper review and testing procedures, and reduces the risk of accidental or malicious changes.",
+      "Url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule#creating-a-branch-protection-rule"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled.py b/prowler/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled.py
new file mode 100644
index 0000000000..a6c9be5a37
--- /dev/null
+++ b/prowler/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled.py
@@ -0,0 +1,38 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportGithub
+from prowler.providers.github.services.repository.repository_client import (
+    repository_client,
+)
+
+
+class repository_default_branch_protection_enabled(Check):
+    """Check if a repository enforces default branch protection
+
+    This class verifies whether each repository enforces default branch protection.
+    """
+
+    def execute(self) -> List[CheckReportGithub]:
+        """Execute the Github Repository Enforces Default Branch Protection check
+
+        Iterates over all repositories and checks if they enforce default branch protection.
+
+        Returns:
+            List[CheckReportGithub]: A list of reports for each repository
+        """
+        findings = []
+        for repo in repository_client.repositories.values():
+            if repo.default_branch_protection is not None:
+                report = CheckReportGithub(
+                    metadata=self.metadata(), resource=repo, repository=repo.name
+                )
+                report.status = "FAIL"
+                report.status_extended = f"Repository {repo.name} does not enforce branch protection on default branch ({repo.default_branch})."
+
+                if repo.default_branch_protection:
+                    report.status = "PASS"
+                    report.status_extended = f"Repository {repo.name} does enforce branch protection on default branch ({repo.default_branch})."
+
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/__init__.py b/prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution.metadata.json b/prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution.metadata.json
new file mode 100644
index 0000000000..e240a6c0d1
--- /dev/null
+++ b/prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution.metadata.json
@@ -0,0 +1,30 @@
+{
+  "Provider": "github",
+  "CheckID": "repository_default_branch_requires_conversation_resolution",
+  "CheckTitle": "Check if repository requires conversation resolution before merging",
+  "CheckType": [],
+  "ServiceName": "repository",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "GitHubRepository",
+  "Description": "Ensure that the repository requires conversation resolution before merging.",
+  "Risk": "Leaving comments unresolved before merging code can lead to overlooked issues, including potential bugs or security vulnerabilities, that might affect the quality and security of the codebase. Unaddressed concerns could result in a lower quality of code, increasing the risk of production failures or breaches.",
+  "RelatedUrl": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-conversation-resolution-before-merging",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Ensure that all comments in a code change proposal are resolved before merging. This guarantees that every reviewer’s concern is addressed, improving code quality and security by preventing issues from being ignored or overlooked.",
+      "Url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution.py b/prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution.py
new file mode 100644
index 0000000000..1bee931478
--- /dev/null
+++ b/prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution.py
@@ -0,0 +1,42 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportGithub
+from prowler.providers.github.services.repository.repository_client import (
+    repository_client,
+)
+
+
+class repository_default_branch_requires_conversation_resolution(Check):
+    """Check if a repository requires conversation resolution
+
+    This class verifies whether each repository requires conversation resolution.
+    """
+
+    def execute(self) -> List[CheckReportGithub]:
+        """Execute the Github Repository Merging Requires Conversation Resolution check
+
+        Iterates over all repositories and checks if they require conversation resolution.
+
+        Returns:
+            List[CheckReportGithub]: A list of reports for each repository
+        """
+        findings = []
+        for repo in repository_client.repositories.values():
+            if repo.conversation_resolution is not None:
+                report = CheckReportGithub(
+                    metadata=self.metadata(), resource=repo, repository=repo.name
+                )
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Repository {repo.name} does not require conversation resolution."
+                )
+
+                if repo.conversation_resolution:
+                    report.status = "PASS"
+                    report.status_extended = (
+                        f"Repository {repo.name} does require conversation resolution."
+                    )
+
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/__init__.py b/prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history.metadata.json b/prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history.metadata.json
new file mode 100644
index 0000000000..b33d6de467
--- /dev/null
+++ b/prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history.metadata.json
@@ -0,0 +1,30 @@
+{
+  "Provider": "github",
+  "CheckID": "repository_default_branch_requires_linear_history",
+  "CheckTitle": "Check if repository default branch requires linear history",
+  "CheckType": [],
+  "ServiceName": "repository",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "GithubRepository",
+  "Description": "Ensure that the repository default branch requires linear history.",
+  "Risk": "Allowing non-linear history can result in a cluttered and difficult-to-trace Git history, making it harder to identify specific changes, debug issues, and understand the sequence of development. This increases the risk of errors, inconsistencies, and bugs, especially in production environments.",
+  "RelatedUrl": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-linear-history",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enforce a linear history by requiring rebase or squash merges for pull requests. This will create a clean, chronological commit history, making it easier to track changes, revert modifications, and troubleshoot any issues that arise.",
+      "Url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history.py b/prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history.py
new file mode 100644
index 0000000000..a06c8b4a3f
--- /dev/null
+++ b/prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history.py
@@ -0,0 +1,38 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportGithub
+from prowler.providers.github.services.repository.repository_client import (
+    repository_client,
+)
+
+
+class repository_default_branch_requires_linear_history(Check):
+    """Check if a repository requires linear history on default branch
+
+    This class verifies whether each repository requires linear history on the default branch.
+    """
+
+    def execute(self) -> List[CheckReportGithub]:
+        """Execute the Github Repository Merging Requires Linear History check
+
+        Iterates over all repositories and checks if they require linear history on the default branch.
+
+        Returns:
+            List[CheckReportGithub]: A list of reports for each repository
+        """
+        findings = []
+        for repo in repository_client.repositories.values():
+            if repo.required_linear_history is not None:
+                report = CheckReportGithub(
+                    metadata=self.metadata(), resource=repo, repository=repo.name
+                )
+                report.status = "FAIL"
+                report.status_extended = f"Repository {repo.name} does not require linear history on default branch ({repo.default_branch})."
+
+                if repo.required_linear_history:
+                    report.status = "PASS"
+                    report.status_extended = f"Repository {repo.name} does require linear history on default branch ({repo.default_branch})."
+
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/__init__.py b/prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals.metadata.json b/prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals.metadata.json
new file mode 100644
index 0000000000..4de957cb40
--- /dev/null
+++ b/prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals.metadata.json
@@ -0,0 +1,30 @@
+{
+  "Provider": "github",
+  "CheckID": "repository_default_branch_requires_multiple_approvals",
+  "CheckTitle": "Check if repositories require at least 2 code changes approvals",
+  "CheckType": [],
+  "ServiceName": "repository",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "github:user-id:repository/repository-name",
+  "Severity": "high",
+  "ResourceType": "GitHubRepository",
+  "Description": "Ensure that repositories require at least 2 code changes approvals before merging a pull request.",
+  "Risk": "If repositories do not require at least 2 code changes approvals before merging a pull request, it is possible that code changes are not being reviewed by multiple people, which could lead to the introduction of bugs or security vulnerabilities.",
+  "RelatedUrl": "https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/approving-a-pull-request-with-required-reviews",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "To require at least 2 code changes approvals before merging a pull request, navigate to the repository settings, click on 'Branches', and then 'Add rule'.",
+      "Url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals.py b/prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals.py
new file mode 100644
index 0000000000..ac75115010
--- /dev/null
+++ b/prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals.py
@@ -0,0 +1,38 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportGithub
+from prowler.providers.github.services.repository.repository_client import (
+    repository_client,
+)
+
+
+class repository_default_branch_requires_multiple_approvals(Check):
+    """Check if a repository enforces at least 2 approvals for code changes
+
+    This class verifies whether each repository enforces at least 2 approvals for code changes.
+    """
+
+    def execute(self) -> List[CheckReportGithub]:
+        """Execute the Github Repository code changes enforce multi approval requirement check
+
+        Iterates over each repository and checks if the repository enforces at least 2 approvals for code changes.
+
+        Returns:
+            List[CheckReportGithub]: A list of reports for each repository
+        """
+        findings = []
+        for repo in repository_client.repositories.values():
+            if repo.approval_count is not None:
+                report = CheckReportGithub(
+                    metadata=self.metadata(), resource=repo, repository=repo.name
+                )
+                report.status = "FAIL"
+                report.status_extended = f"Repository {repo.name} does not enforce at least 2 approvals for code changes."
+
+                if repo.approval_count >= 2:
+                    report.status = "PASS"
+                    report.status_extended = f"Repository {repo.name} does enforce at least 2 approvals for code changes."
+
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/github/services/repository/repository_default_branch_status_checks_required/__init__.py b/prowler/providers/github/services/repository/repository_default_branch_status_checks_required/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required.metadata.json b/prowler/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required.metadata.json
new file mode 100644
index 0000000000..e9d846bc2f
--- /dev/null
+++ b/prowler/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required.metadata.json
@@ -0,0 +1,30 @@
+{
+  "Provider": "github",
+  "CheckID": "repository_default_branch_status_checks_required",
+  "CheckTitle": "Check if repository enforces status checks to pass",
+  "CheckType": [],
+  "ServiceName": "repository",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "GithubRepository",
+  "Description": "Ensure that the repository enforces status checks to pass before merging code into the main branch.",
+  "Risk": "Merging code without requiring all checks to pass increases the risk of introducing bugs, vulnerabilities, or unstable changes into the codebase. This can compromise the quality, security, and functionality of the application.",
+  "RelatedUrl": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Require all predefined status checks to pass successfully before allowing code changes to be merged. This ensures that all quality, stability, and security conditions are met, reducing the likelihood of errors or vulnerabilities being introduced into the project.",
+      "Url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required.py b/prowler/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required.py
new file mode 100644
index 0000000000..21d6b173da
--- /dev/null
+++ b/prowler/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required.py
@@ -0,0 +1,42 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportGithub
+from prowler.providers.github.services.repository.repository_client import (
+    repository_client,
+)
+
+
+class repository_default_branch_status_checks_required(Check):
+    """Check if a repository enforces status checks.
+
+    This class verifies whether each repository enforces status checks.
+    """
+
+    def execute(self) -> List[CheckReportGithub]:
+        """Execute the Github Repository
+
+        Iterates over all repositories and checks if they enforce status checks.
+
+        Returns:
+            List[CheckReportGithub]: A list of reports for each repository.
+        """
+        findings = []
+        for repo in repository_client.repositories.values():
+            if repo.status_checks is not None:
+                report = CheckReportGithub(
+                    self.metadata(), resource=repo, repository=repo.name
+                )
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Repository {repo.name} does not enforce status checks."
+                )
+
+                if repo.status_checks:
+                    report.status = "PASS"
+                    report.status_extended = (
+                        f"Repository {repo.name} does enforce status checks."
+                    )
+
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/github/services/repository/repository_public_has_securitymd_file/repository_public_has_securitymd_file.metadata.json b/prowler/providers/github/services/repository/repository_public_has_securitymd_file/repository_public_has_securitymd_file.metadata.json
index 69c9446aa7..4b2cdf24f8 100644
--- a/prowler/providers/github/services/repository/repository_public_has_securitymd_file/repository_public_has_securitymd_file.metadata.json
+++ b/prowler/providers/github/services/repository/repository_public_has_securitymd_file/repository_public_has_securitymd_file.metadata.json
@@ -7,7 +7,7 @@
   "SubServiceName": "",
   "ResourceIdTemplate": "github:user-id:repository/repository-name",
   "Severity": "low",
-  "ResourceType": "Other",
+  "ResourceType": "GitHubRepository",
   "Description": "Ensure that public repositories have a SECURITY.md file",
   "Risk": "Not having a SECURITY.md file in a public repository may lead to security vulnerabilities being overlooked by users and contributors.",
   "RelatedUrl": "https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository",
diff --git a/prowler/providers/github/services/repository/repository_public_has_securitymd_file/repository_public_has_securitymd_file.py b/prowler/providers/github/services/repository/repository_public_has_securitymd_file/repository_public_has_securitymd_file.py
index 342b8f5e9f..c1ec7b51e4 100644
--- a/prowler/providers/github/services/repository/repository_public_has_securitymd_file/repository_public_has_securitymd_file.py
+++ b/prowler/providers/github/services/repository/repository_public_has_securitymd_file/repository_public_has_securitymd_file.py
@@ -22,7 +22,7 @@ class repository_public_has_securitymd_file(Check):
         """
         findings = []
         for repo in repository_client.repositories.values():
-            if not repo.private:
+            if not repo.private and repo.securitymd is not None:
                 report = CheckReportGithub(
                     metadata=self.metadata(), resource=repo, repository=repo.name
                 )
diff --git a/prowler/providers/github/services/repository/repository_service.py b/prowler/providers/github/services/repository/repository_service.py
index f7c2c02760..571dda3429 100644
--- a/prowler/providers/github/services/repository/repository_service.py
+++ b/prowler/providers/github/services/repository/repository_service.py
@@ -17,17 +17,99 @@ class Repository(GithubService):
         try:
             for client in self.clients:
                 for repo in client.get_user().get_repos():
+                    default_branch = repo.default_branch
+                    delete_branch_on_merge = (
+                        repo.delete_branch_on_merge
+                        if repo.delete_branch_on_merge is not None
+                        else False
+                    )
+                    securitymd_exists = False
                     try:
                         securitymd_exists = repo.get_contents("SECURITY.md") is not None
-                    except Exception:
-                        securitymd_exists = False
+                    except Exception as error:
+                        if "404" in str(error):
+                            securitymd_exists = False
+                        else:
+                            logger.error(
+                                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                            )
+                            securitymd_exists = None
+
+                    require_pr = False
+                    approval_cnt = 0
+                    branch_protection = False
+                    required_linear_history = False
+                    allow_force_pushes = True
+                    branch_deletion = True
+                    status_checks = False
+                    enforce_admins = False
+                    conversation_resolution = False
+                    try:
+                        branch = repo.get_branch(default_branch)
+                        if branch.protected:
+                            protection = branch.get_protection()
+                            if protection:
+                                require_pr = (
+                                    protection.required_pull_request_reviews is not None
+                                )
+                                approval_cnt = (
+                                    protection.required_pull_request_reviews.required_approving_review_count
+                                    if require_pr
+                                    else 0
+                                )
+                                required_linear_history = (
+                                    protection.required_linear_history
+                                )
+                                allow_force_pushes = protection.allow_force_pushes
+                                branch_deletion = protection.allow_deletions
+                                status_checks = (
+                                    protection.required_status_checks is not None
+                                )
+                                enforce_admins = protection.enforce_admins
+                                conversation_resolution = (
+                                    protection.required_conversation_resolution
+                                )
+                                branch_protection = True
+                    except Exception as error:
+                        # If the branch is not found, it is not protected
+                        if "404" in str(error):
+                            logger.warning(
+                                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                            )
+                        # Any other error, we cannot know if the branch is protected or not
+                        else:
+                            require_pr = None
+                            approval_cnt = None
+                            branch_protection = None
+                            required_linear_history = None
+                            allow_force_pushes = None
+                            branch_deletion = None
+                            status_checks = None
+                            enforce_admins = None
+                            conversation_resolution = None
+                            logger.error(
+                                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                            )
+
                     repos[repo.id] = Repo(
                         id=repo.id,
                         name=repo.name,
                         full_name=repo.full_name,
+                        default_branch=repo.default_branch,
                         private=repo.private,
                         securitymd=securitymd_exists,
+                        require_pull_request=require_pr,
+                        approval_count=approval_cnt,
+                        required_linear_history=required_linear_history,
+                        allow_force_pushes=allow_force_pushes,
+                        default_branch_deletion=branch_deletion,
+                        status_checks=status_checks,
+                        enforce_admins=enforce_admins,
+                        conversation_resolution=conversation_resolution,
+                        default_branch_protection=branch_protection,
+                        delete_branch_on_merge=delete_branch_on_merge,
                     )
+
         except Exception as error:
             logger.error(
                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -41,5 +123,16 @@ class Repo(BaseModel):
     id: int
     name: str
     full_name: str
+    default_branch_protection: Optional[bool]
+    default_branch: str
     private: bool
-    securitymd: Optional[bool] = False
+    securitymd: Optional[bool]
+    require_pull_request: Optional[bool]
+    required_linear_history: Optional[bool]
+    allow_force_pushes: Optional[bool]
+    default_branch_deletion: Optional[bool]
+    status_checks: Optional[bool]
+    enforce_admins: Optional[bool]
+    approval_count: Optional[int]
+    delete_branch_on_merge: Optional[bool]
+    conversation_resolution: Optional[bool]
diff --git a/prowler/providers/m365/lib/powershell/m365_powershell.py b/prowler/providers/m365/lib/powershell/m365_powershell.py
index f32921b001..9dbda1c01e 100644
--- a/prowler/providers/m365/lib/powershell/m365_powershell.py
+++ b/prowler/providers/m365/lib/powershell/m365_powershell.py
@@ -7,7 +7,7 @@ from prowler.lib.powershell.powershell import PowerShellSession
 from prowler.providers.m365.exceptions.exceptions import (
     M365UserNotBelongingToTenantError,
 )
-from prowler.providers.m365.models import M365Credentials
+from prowler.providers.m365.models import M365Credentials, M365IdentityInfo
 
 
 class M365PowerShell(PowerShellSession):
@@ -34,7 +34,7 @@ class M365PowerShell(PowerShellSession):
         to be installed and available in the PowerShell environment.
     """
 
-    def __init__(self, credentials: M365Credentials):
+    def __init__(self, credentials: M365Credentials, identity: M365IdentityInfo):
         """
         Initialize a Microsoft 365 PowerShell session.
 
@@ -46,6 +46,7 @@ class M365PowerShell(PowerShellSession):
                 for authentication.
         """
         super().__init__()
+        self.tenant_identity = identity
         self.init_credential(credentials)
 
     def init_credential(self, credentials: M365Credentials) -> None:
@@ -95,12 +96,24 @@ class M365PowerShell(PowerShellSession):
             'Write-Output "$($credential.GetNetworkCredential().Password)"'
         )
 
+        # Validate user belongs to tenant
+        user_domain = credentials.user.split("@")[1]
+        if not any(
+            user_domain.endswith(domain)
+            for domain in self.tenant_identity.tenant_domains
+        ):
+            raise M365UserNotBelongingToTenantError(
+                file=os.path.basename(__file__),
+                message=f"The user domain {user_domain} does not match any of the tenant domains: {', '.join(self.tenant_identity.tenant_domains)}",
+            )
+
         app = msal.ConfidentialClientApplication(
             client_id=credentials.client_id,
             client_credential=credentials.client_secret,
             authority=f"https://login.microsoftonline.com/{credentials.tenant_id}",
         )
 
+        # Validate credentials
         result = app.acquire_token_by_username_password(
             username=credentials.user,
             password=decrypted_password,  # Needs to be in plain text
@@ -113,14 +126,6 @@ class M365PowerShell(PowerShellSession):
         if "access_token" not in result:
             return False
 
-        # Validate user credentials belong to tenant
-        user_domain = credentials.user.split("@")[1]
-        if not credentials.provider_id.endswith(user_domain):
-            raise M365UserNotBelongingToTenantError(
-                file=os.path.basename(__file__),
-                message="The provided M365 User does not belong to the specified tenant.",
-            )
-
         return True
 
     def connect_microsoft_teams(self) -> dict:
diff --git a/prowler/providers/m365/lib/service/service.py b/prowler/providers/m365/lib/service/service.py
index b218aac283..8806c99728 100644
--- a/prowler/providers/m365/lib/service/service.py
+++ b/prowler/providers/m365/lib/service/service.py
@@ -15,5 +15,7 @@ class M365Service:
 
         # Initialize PowerShell client only if credentials are available
         self.powershell = (
-            M365PowerShell(provider.credentials) if provider.credentials else None
+            M365PowerShell(provider.credentials, provider.identity)
+            if provider.credentials and provider.identity
+            else None
         )
diff --git a/prowler/providers/m365/m365_provider.py b/prowler/providers/m365/m365_provider.py
index 2b766171e6..a4135b0692 100644
--- a/prowler/providers/m365/m365_provider.py
+++ b/prowler/providers/m365/m365_provider.py
@@ -194,20 +194,17 @@ class M365Provider(Provider):
 
         # Set up the identity
         self._identity = self.setup_identity(
-            az_cli_auth,
             sp_env_auth,
             env_auth,
-            browser_auth,
-            client_id,
+            self._session,
         )
 
         # Set up PowerShell session credentials
         self._credentials = self.setup_powershell(
             env_auth=env_auth,
             m365_credentials=m365_credentials,
-            provider_id=self.identity.tenant_domain,
-            init_modules=init_modules,
             identity=self.identity,
+            init_modules=init_modules,
         )
 
         # Audit Config
@@ -381,9 +378,8 @@ class M365Provider(Provider):
     def setup_powershell(
         env_auth: bool = False,
         m365_credentials: dict = {},
-        provider_id: str = None,
-        init_modules: bool = False,
         identity: M365IdentityInfo = None,
+        init_modules: bool = False,
     ) -> M365Credentials:
         """Gets the M365 credentials.
 
@@ -404,7 +400,7 @@ class M365Provider(Provider):
                 client_id=m365_credentials.get("client_id", ""),
                 client_secret=m365_credentials.get("client_secret", ""),
                 tenant_id=m365_credentials.get("tenant_id", ""),
-                provider_id=provider_id,
+                tenant_domains=identity.tenant_domains,
             )
         elif env_auth:
             m365_user = getenv("M365_USER")
@@ -422,19 +418,18 @@ class M365Provider(Provider):
                     message="Missing M365_USER or M365_ENCRYPTED_PASSWORD environment variables required for credentials authentication.",
                 )
             credentials = M365Credentials(
-                user=m365_user,
-                passwd=m365_password,
                 client_id=client_id,
                 client_secret=client_secret,
                 tenant_id=tenant_id,
-                provider_id=provider_id,
+                tenant_domains=identity.tenant_domains,
+                user=m365_user,
+                passwd=m365_password,
             )
 
         if credentials:
             if identity:
-                identity.identity_type = "Service Principal and User Credentials"
                 identity.user = credentials.user
-            test_session = M365PowerShell(credentials)
+            test_session = M365PowerShell(credentials, identity)
             try:
                 if test_session.test_credentials(credentials):
                     if init_modules:
@@ -704,7 +699,7 @@ class M365Provider(Provider):
                     )
 
             # Set up the M365 session
-            credentials = M365Provider.setup_session(
+            session = M365Provider.setup_session(
                 az_cli_auth,
                 sp_env_auth,
                 env_auth,
@@ -714,16 +709,35 @@ class M365Provider(Provider):
                 region_config,
             )
 
-            GraphServiceClient(credentials=credentials)
+            GraphServiceClient(credentials=session)
 
             logger.info("M365 provider: Connection to MSGraph successful")
 
+            # Set up Identity
+            identity = M365Provider.setup_identity(
+                sp_env_auth,
+                env_auth,
+                session,
+            )
+
+            if not identity:
+                raise M365GetTokenIdentityError(
+                    file=os.path.basename(__file__),
+                    message="Failed to retrieve M365 identity",
+                )
+
+            if provider_id not in identity.tenant_domains:
+                raise M365InvalidProviderIdError(
+                    file=os.path.basename(__file__),
+                    message=f"The provider ID {provider_id} does not match any of the service principal tenant domains: {', '.join(identity.tenant_domains)}",
+                )
+
             # Set up PowerShell credentials
             if user and encrypted_password:
                 M365Provider.setup_powershell(
                     env_auth,
                     m365_credentials,
-                    provider_id,
+                    identity,
                 )
             else:
                 logger.info(
@@ -732,15 +746,6 @@ class M365Provider(Provider):
 
             logger.info("M365 provider: Connection to PowerShell successful")
 
-            # Check that user domain, provider_id and Graph client tenant_domain are the same
-            if user and encrypted_password:
-                user_domain = user.split("@")[1]
-                if provider_id and user_domain != provider_id:
-                    raise M365InvalidProviderIdError(
-                        file=os.path.basename(__file__),
-                        message=f"Provider ID {provider_id} does not match Application tenant domain {user_domain}",
-                    )
-
             return Connection(is_connected=True)
 
         # Exceptions from setup_region_config
@@ -867,13 +872,11 @@ class M365Provider(Provider):
                     message=f"Missing environment variable {env_var} required to authenticate.",
                 )
 
+    @staticmethod
     def setup_identity(
-        self,
-        az_cli_auth,
         sp_env_auth,
         env_auth,
-        browser_auth,
-        client_id,
+        session,
     ):
         """
         Sets up the identity for the M365 provider.
@@ -888,7 +891,7 @@ class M365Provider(Provider):
         Returns:
             M365IdentityInfo: An instance of M365IdentityInfo containing the identity information.
         """
-        credentials = self.session
+        logger.info("M365 provider: Setting up identity ...")
         # TODO: fill this object with real values not default and set to none
         identity = M365IdentityInfo()
 
@@ -896,74 +899,75 @@ class M365Provider(Provider):
         # the identity can access AAD and retrieve the tenant domain name.
         # With cli also should be possible but right now it does not work, m365 python package issue is coming
         # At the time of writting this with az cli creds is not working, despite that is included
-        if env_auth or az_cli_auth or sp_env_auth or browser_auth or client_id:
 
-            async def get_m365_identity():
-                # Trying to recover tenant domain info
+        async def get_m365_identity(identity):
+            # Trying to recover tenant domain info
+            try:
+                logger.info(
+                    "Trying to retrieve tenant domain from AAD to populate identity structure ..."
+                )
+                client = GraphServiceClient(credentials=session)
+
+                domain_result = await client.domains.get()
+                if getattr(domain_result, "value"):
+                    if getattr(domain_result.value[0], "id"):
+                        identity.tenant_domain = domain_result.value[0].id
+                        for domain in domain_result.value:
+                            identity.tenant_domains.append(domain.id)
+
+            except HttpResponseError as error:
+                logger.error(
+                    f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
+                )
+                raise M365HTTPResponseError(
+                    file=os.path.basename(__file__),
+                    original_exception=error,
+                )
+            except ClientAuthenticationError as error:
+                logger.error(
+                    f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
+                )
+                raise M365GetTokenIdentityError(
+                    file=os.path.basename(__file__),
+                    original_exception=error,
+                )
+            except Exception as error:
+                logger.error(
+                    f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
+                )
+            # since that exception is not considered as critical, we keep filling another identity fields
+            identity.identity_id = (
+                getenv("AZURE_CLIENT_ID") or "Unknown user id (Missing AAD permissions)"
+            )
+            if sp_env_auth:
+                identity.identity_type = "Service Principal"
+            elif env_auth:
+                identity.identity_type = "Service Principal and User Credentials"
+            else:
+                identity.identity_type = "User"
                 try:
                     logger.info(
-                        "Trying to retrieve tenant domain from AAD to populate identity structure ..."
+                        "Trying to retrieve user information from AAD to populate identity structure ..."
                     )
-                    client = GraphServiceClient(credentials=credentials)
+                    client = GraphServiceClient(credentials=session)
 
-                    domain_result = await client.domains.get()
-                    if getattr(domain_result, "value"):
-                        if getattr(domain_result.value[0], "id"):
-                            identity.tenant_domain = domain_result.value[0].id
+                    me = await client.me.get()
+                    if me:
+                        if getattr(me, "user_principal_name"):
+                            identity.identity_id = me.user_principal_name
 
-                except HttpResponseError as error:
-                    logger.error(
-                        f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
-                    )
-                    raise M365HTTPResponseError(
-                        file=os.path.basename(__file__),
-                        original_exception=error,
-                    )
-                except ClientAuthenticationError as error:
-                    logger.error(
-                        f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
-                    )
-                    raise M365GetTokenIdentityError(
-                        file=os.path.basename(__file__),
-                        original_exception=error,
-                    )
                 except Exception as error:
                     logger.error(
                         f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
                     )
-                # since that exception is not considered as critical, we keep filling another identity fields
-                if sp_env_auth or env_auth or client_id:
-                    # The id of the sp can be retrieved from environment variables
-                    identity.identity_id = getenv("AZURE_CLIENT_ID")
-                    identity.identity_type = "Service Principal"
-                # Same here, if user can access AAD, some fields are retrieved if not, default value, for az cli
-                # should work but it doesn't, pending issue
-                else:
-                    identity.identity_id = "Unknown user id (Missing AAD permissions)"
-                    identity.identity_type = "User"
-                    try:
-                        logger.info(
-                            "Trying to retrieve user information from AAD to populate identity structure ..."
-                        )
-                        client = GraphServiceClient(credentials=credentials)
 
-                        me = await client.me.get()
-                        if me:
-                            if getattr(me, "user_principal_name"):
-                                identity.identity_id = me.user_principal_name
+            # Retrieve tenant id from the client
+            client = GraphServiceClient(credentials=session)
+            organization_info = await client.organization.get()
+            identity.tenant_id = organization_info.value[0].id
 
-                    except Exception as error:
-                        logger.error(
-                            f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
-                        )
-
-                # Retrieve tenant id from the client
-                client = GraphServiceClient(credentials=credentials)
-                organization_info = await client.organization.get()
-                identity.tenant_id = organization_info.value[0].id
-
-            asyncio.get_event_loop().run_until_complete(get_m365_identity())
-            return identity
+        asyncio.get_event_loop().run_until_complete(get_m365_identity(identity))
+        return identity
 
     @staticmethod
     def validate_static_credentials(
diff --git a/prowler/providers/m365/models.py b/prowler/providers/m365/models.py
index 198c54e33e..d0d73263b5 100644
--- a/prowler/providers/m365/models.py
+++ b/prowler/providers/m365/models.py
@@ -8,7 +8,8 @@ class M365IdentityInfo(BaseModel):
     identity_id: str = ""
     identity_type: str = ""
     tenant_id: str = ""
-    tenant_domain: str = "Unknown tenant domain (missing AAD permissions)"
+    tenant_domain: str = "Unknown tenant domain (missing Entra permissions)"
+    tenant_domains: list[str] = []
     location: str = ""
     user: str = None
 
@@ -21,12 +22,12 @@ class M365RegionConfig(BaseModel):
 
 
 class M365Credentials(BaseModel):
-    user: str = ""
-    passwd: str = ""
     client_id: str = ""
     client_secret: str = ""
     tenant_id: str = ""
-    provider_id: str = ""
+    tenant_domains: list[str] = []
+    user: str = ""
+    passwd: str = ""
 
 
 class M365OutputOptions(ProviderOutputOptions):
diff --git a/tests/lib/outputs/compliance/cis/cis_m365_test.py b/tests/lib/outputs/compliance/cis/cis_m365_test.py
new file mode 100644
index 0000000000..1c8232d73a
--- /dev/null
+++ b/tests/lib/outputs/compliance/cis/cis_m365_test.py
@@ -0,0 +1,182 @@
+from datetime import datetime
+from io import StringIO
+
+from freezegun import freeze_time
+from mock import patch
+
+from prowler.lib.outputs.compliance.cis.cis_m365 import M365CIS
+from prowler.lib.outputs.compliance.cis.models import M365CISModel
+from tests.lib.outputs.compliance.fixtures import CIS_4_0_M365
+from tests.lib.outputs.fixtures.fixtures import generate_finding_output
+from tests.providers.m365.m365_fixtures import DOMAIN, LOCATION, TENANT_ID
+
+
+class TestM365CIS:
+    def test_output_transform(self):
+        findings = [
+            generate_finding_output(
+                provider="m365",
+                compliance={"CIS-4.0": "2.1.3"},
+                account_name=DOMAIN,
+                account_uid=TENANT_ID,
+                region=LOCATION,
+            )
+        ]
+        # Clear the data from CSV class
+        output = M365CIS(findings, CIS_4_0_M365)
+        output_data = output.data[0]
+        assert isinstance(output_data, M365CISModel)
+        assert output_data.Provider == "m365"
+        assert output_data.TenantId == TENANT_ID
+        assert output_data.Location == LOCATION
+        assert output_data.Description == CIS_4_0_M365.Description
+        assert output_data.Requirements_Id == CIS_4_0_M365.Requirements[0].Id
+        assert (
+            output_data.Requirements_Description
+            == CIS_4_0_M365.Requirements[0].Description
+        )
+        assert (
+            output_data.Requirements_Attributes_Section
+            == CIS_4_0_M365.Requirements[0].Attributes[0].Section
+        )
+        assert (
+            output_data.Requirements_Attributes_SubSection
+            == CIS_4_0_M365.Requirements[0].Attributes[0].SubSection
+        )
+        assert (
+            output_data.Requirements_Attributes_Profile
+            == CIS_4_0_M365.Requirements[0].Attributes[0].Profile
+        )
+        assert (
+            output_data.Requirements_Attributes_AssessmentStatus
+            == CIS_4_0_M365.Requirements[0].Attributes[0].AssessmentStatus
+        )
+        assert (
+            output_data.Requirements_Attributes_Description
+            == CIS_4_0_M365.Requirements[0].Attributes[0].Description
+        )
+        assert (
+            output_data.Requirements_Attributes_RationaleStatement
+            == CIS_4_0_M365.Requirements[0].Attributes[0].RationaleStatement
+        )
+        assert (
+            output_data.Requirements_Attributes_ImpactStatement
+            == CIS_4_0_M365.Requirements[0].Attributes[0].ImpactStatement
+        )
+        assert (
+            output_data.Requirements_Attributes_RemediationProcedure
+            == CIS_4_0_M365.Requirements[0].Attributes[0].RemediationProcedure
+        )
+        assert (
+            output_data.Requirements_Attributes_AuditProcedure
+            == CIS_4_0_M365.Requirements[0].Attributes[0].AuditProcedure
+        )
+        assert (
+            output_data.Requirements_Attributes_AdditionalInformation
+            == CIS_4_0_M365.Requirements[0].Attributes[0].AdditionalInformation
+        )
+        assert (
+            output_data.Requirements_Attributes_References
+            == CIS_4_0_M365.Requirements[0].Attributes[0].References
+        )
+        assert (
+            output_data.Requirements_Attributes_DefaultValue
+            == CIS_4_0_M365.Requirements[0].Attributes[0].DefaultValue
+        )
+        assert output_data.Status == "PASS"
+        assert output_data.StatusExtended == ""
+        assert output_data.ResourceId == ""
+        assert output_data.ResourceName == ""
+        assert output_data.CheckId == "test-check-id"
+        assert output_data.Muted is False
+        # Test manual check
+        output_data_manual = output.data[1]
+        assert output_data_manual.Provider == "m365"
+        assert output_data_manual.TenantId == TENANT_ID
+        assert output_data_manual.Location == LOCATION
+        assert output_data_manual.Description == CIS_4_0_M365.Description
+        assert output_data_manual.Requirements_Id == CIS_4_0_M365.Requirements[1].Id
+        assert (
+            output_data_manual.Requirements_Description
+            == CIS_4_0_M365.Requirements[1].Description
+        )
+        assert (
+            output_data_manual.Requirements_Attributes_Section
+            == CIS_4_0_M365.Requirements[1].Attributes[0].Section
+        )
+        assert (
+            output_data.Requirements_Attributes_SubSection
+            == CIS_4_0_M365.Requirements[0].Attributes[0].SubSection
+        )
+        assert (
+            output_data_manual.Requirements_Attributes_Profile
+            == CIS_4_0_M365.Requirements[1].Attributes[0].Profile
+        )
+        assert (
+            output_data_manual.Requirements_Attributes_AssessmentStatus
+            == CIS_4_0_M365.Requirements[1].Attributes[0].AssessmentStatus
+        )
+        assert (
+            output_data_manual.Requirements_Attributes_Description
+            == CIS_4_0_M365.Requirements[1].Attributes[0].Description
+        )
+        assert (
+            output_data_manual.Requirements_Attributes_RationaleStatement
+            == CIS_4_0_M365.Requirements[1].Attributes[0].RationaleStatement
+        )
+        assert (
+            output_data_manual.Requirements_Attributes_ImpactStatement
+            == CIS_4_0_M365.Requirements[1].Attributes[0].ImpactStatement
+        )
+        assert (
+            output_data_manual.Requirements_Attributes_RemediationProcedure
+            == CIS_4_0_M365.Requirements[1].Attributes[0].RemediationProcedure
+        )
+        assert (
+            output_data_manual.Requirements_Attributes_AuditProcedure
+            == CIS_4_0_M365.Requirements[1].Attributes[0].AuditProcedure
+        )
+        assert (
+            output_data_manual.Requirements_Attributes_AdditionalInformation
+            == CIS_4_0_M365.Requirements[1].Attributes[0].AdditionalInformation
+        )
+        assert (
+            output_data_manual.Requirements_Attributes_References
+            == CIS_4_0_M365.Requirements[1].Attributes[0].References
+        )
+        assert (
+            output_data_manual.Requirements_Attributes_DefaultValue
+            == CIS_4_0_M365.Requirements[1].Attributes[0].DefaultValue
+        )
+        assert output_data_manual.Status == "MANUAL"
+        assert output_data_manual.StatusExtended == "Manual check"
+        assert output_data_manual.ResourceId == "manual_check"
+        assert output_data_manual.ResourceName == "Manual check"
+        assert output_data_manual.CheckId == "manual"
+        assert output_data_manual.Muted is False
+
+    @freeze_time(datetime.now())
+    def test_batch_write_data_to_file(self):
+        mock_file = StringIO()
+        findings = [
+            generate_finding_output(
+                provider="m365",
+                compliance={"CIS-4.0": "2.1.3"},
+                account_name=DOMAIN,
+                account_uid=TENANT_ID,
+                region=LOCATION,
+            )
+        ]
+        # Clear the data from CSV class
+        output = M365CIS(findings, CIS_4_0_M365)
+        output._file_descriptor = mock_file
+
+        with patch.object(mock_file, "close", return_value=None):
+            output.batch_write_data_to_file()
+
+        mock_file.seek(0)
+        content = mock_file.read()
+
+        expected_csv = f"PROVIDER;DESCRIPTION;TENANTID;LOCATION;ASSESSMENTDATE;REQUIREMENTS_ID;REQUIREMENTS_DESCRIPTION;REQUIREMENTS_ATTRIBUTES_SECTION;REQUIREMENTS_ATTRIBUTES_SUBSECTION;REQUIREMENTS_ATTRIBUTES_PROFILE;REQUIREMENTS_ATTRIBUTES_ASSESSMENTSTATUS;REQUIREMENTS_ATTRIBUTES_DESCRIPTION;REQUIREMENTS_ATTRIBUTES_RATIONALESTATEMENT;REQUIREMENTS_ATTRIBUTES_IMPACTSTATEMENT;REQUIREMENTS_ATTRIBUTES_REMEDIATIONPROCEDURE;REQUIREMENTS_ATTRIBUTES_AUDITPROCEDURE;REQUIREMENTS_ATTRIBUTES_ADDITIONALINFORMATION;REQUIREMENTS_ATTRIBUTES_DEFAULTVALUE;REQUIREMENTS_ATTRIBUTES_REFERENCES;STATUS;STATUSEXTENDED;RESOURCEID;RESOURCENAME;CHECKID;MUTED\r\nm365;The CIS Microsoft 365 Foundations Benchmark provides prescriptive guidance for configuring security options for Microsoft 365 with an emphasis on foundational, testable, and architecture agnostic settings.;00000000-0000-0000-0000-000000000000;global;{datetime.now()};2.1.3;Ensure MFA Delete is enabled on S3 buckets;2.1. Simple Storage Service (S3);;Level 1;Automated;Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.;Adding MFA delete to an S3 bucket, requires additional authentication when you change the version state of your bucket or you delete and object version adding another layer of security in the event your security credentials are compromised or unauthorized access is granted.;;Perform the steps below to enable MFA delete on an S3 bucket.Note:-You cannot enable MFA Delete using the AWS Management Console. You must use the AWS CLI or API.-You must use your 'root' account to enable MFA Delete on S3 buckets.**From Command line:**1. Run the s3api put-bucket-versioning command aws s3api put-bucket-versioning --profile my-root-profile --bucket Bucket_Name --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa arn:aws:iam::aws_account_id:mfa/root-account-mfa-device passcode;Perform the steps below to confirm MFA delete is configured on an S3 Bucket**From Console:**1. Login to the S3 console at `https://console.aws.amazon.com/s3/`2. Click the `Check` box next to the Bucket name you want to confirm3. In the window under `Properties`4. Confirm that Versioning is `Enabled`5. Confirm that MFA Delete is `Enabled`**From Command Line:**1. Run the `get-bucket-versioning aws s3api get-bucket-versioning --bucket my-bucket Output example:   Enabled Enabled\ If the Console or the CLI output does not show Versioning and MFA Delete `enabled` refer to the remediation below.;;By default, MFA Delete is not enabled on S3 buckets.;https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html#MultiFactorAuthenticationDelete:https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingMFADelete.html:https://aws.amazon.com/blogs/security/securing-access-to-aws-using-mfa-part-3/:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_lost-or-broken.html;PASS;;;;test-check-id;False\r\nm365;The CIS Microsoft 365 Foundations Benchmark provides prescriptive guidance for configuring security options for Microsoft 365 with an emphasis on foundational, testable, and architecture agnostic settings.;00000000-0000-0000-0000-000000000000;global;{datetime.now()};2.1.4;Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive;1.1 Control Plane Node Configuration Files;;Level 1 - Master Node;Automated;Ensure that the controller manager pod specification file has permissions of `600` or more restrictive.;The controller manager pod specification file controls various parameters that set the behavior of the Controller Manager on the master node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.;;Run the below command (based on the file location on your system) on the Control Plane node. For example,  ``` chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml ```;Run the below command (based on the file location on your system) on the Control Plane node. For example,  ``` stat -c %a /etc/kubernetes/manifests/kube-controller-manager.yaml ```  Verify that the permissions are `600` or more restrictive.;;By default, the `kube-controller-manager.yaml` file has permissions of `640`.;https://kubernetes.io/docs/admin/kube-apiserver/;MANUAL;Manual check;manual_check;Manual check;manual;False\r\n"
+
+        assert content == expected_csv
diff --git a/tests/lib/outputs/compliance/compliance_test.py b/tests/lib/outputs/compliance/compliance_test.py
index d9458bc6b0..b2fc94488f 100644
--- a/tests/lib/outputs/compliance/compliance_test.py
+++ b/tests/lib/outputs/compliance/compliance_test.py
@@ -330,3 +330,55 @@ class TestCompliance:
             "CIS-2.0": ["2.1.3"],
             "CIS-2.1": ["2.1.3"],
         }
+
+    def test_get_check_compliance_github(self):
+        check_compliance = [
+            Compliance(
+                Framework="CIS",
+                Provider="Github",
+                Version="1.0",
+                Description="This document provides prescriptive guidance for establishing a secure configuration posture for securing GitHub.",
+                Requirements=[
+                    Compliance_Requirement(
+                        Checks=[],
+                        Id="1.1.11",
+                        Description="Ensure all open comments are resolved before allowing code change merging",
+                        Attributes=[
+                            CIS_Requirement_Attribute(
+                                Section="1.1",
+                                Profile="Level 2",
+                                AssessmentStatus="Manual",
+                                Description='Organizations should enforce a "no open comments" policy before allowing code change merging.',
+                                RationaleStatement="In an open code change proposal, reviewers can leave comments containing their questions and suggestions. These comments can also include potential bugs and security issues. Requiring all comments on a code change proposal to be resolved before it can be merged ensures that every concern is properly addressed or acknowledged before the new code changes are introduced to the code base.",
+                                ImpactStatement="Code change proposals containing open comments would not be able to be merged into the code base.",
+                                RemediationProcedure='For each code repository in use, require open comments to be resolved before the relevant code change can be merged by performing the following:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the "Code and automation" section of the sidebar, click **Branches**.\n 4. Next to "Branch protection rules", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn\'t, click **Add rule**.\n 5. If you add the rule, under "Branch name pattern", type the branch name or pattern you want to protect.\n 6. Select **Require conversation resolution before merging**.\n 7. Click **Create** or **Save changes**.',
+                                AuditProcedure='For every code repository in use, verify that each merged code change does not contain open, unattended comments by performing the following:\n \n\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. In the "Code and automation" section of the sidebar, click **Branches**.\n 4. Next to "Branch protection rules", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn\'t, you are not compliant.\n 5. Ensure that **Require conversation resolution before merging** is checked.',
+                                AdditionalInformation="",
+                                References="",
+                            )
+                        ],
+                    )
+                ],
+            )
+        ]
+
+        finding = Check_Report(
+            metadata=load_check_metadata(
+                f"{path.dirname(path.realpath(__file__))}/../fixtures/metadata.json"
+            ).json(),
+            resource={},
+        )
+        finding.resource_details = "Test resource details"
+        finding.resource_id = "test-resource"
+        finding.resource_arn = "test-arn"
+        finding.region = "eu-west-1"
+        finding.status = "PASS"
+        finding.status_extended = "This is a test"
+
+        bulk_checks_metadata = {}
+        bulk_checks_metadata["iam_user_accesskey_unused"] = mock.MagicMock()
+        bulk_checks_metadata["iam_user_accesskey_unused"].Compliance = check_compliance
+
+        assert get_check_compliance(finding, "github", bulk_checks_metadata) == {
+            "CIS-1.0": ["1.1.11"],
+        }
diff --git a/tests/lib/outputs/compliance/fixtures.py b/tests/lib/outputs/compliance/fixtures.py
index 3c8b71e3cd..94c9604cf3 100644
--- a/tests/lib/outputs/compliance/fixtures.py
+++ b/tests/lib/outputs/compliance/fixtures.py
@@ -243,6 +243,58 @@ CIS_1_5_AWS = Compliance(
     ],
 )
 
+CIS_4_0_M365_NAME = "cis_4.0_m365"
+CIS_4_0_M365 = Compliance(
+    Framework="CIS",
+    Provider="M365",
+    Version="4.0",
+    Description="The CIS Microsoft 365 Foundations Benchmark provides prescriptive guidance for configuring security options for Microsoft 365 with an emphasis on foundational, testable, and architecture agnostic settings.",
+    Requirements=[
+        Compliance_Requirement(
+            Checks=[
+                "mfa_delete_enabled",
+            ],
+            Id="2.1.3",
+            Description="Ensure MFA Delete is enabled on S3 buckets",
+            Attributes=[
+                CIS_Requirement_Attribute(
+                    Section="2.1. Simple Storage Service (S3)",
+                    Profile="Level 1",
+                    AssessmentStatus="Automated",
+                    Description="Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.",
+                    RationaleStatement="Adding MFA delete to an S3 bucket, requires additional authentication when you change the version state of your bucket or you delete and object version adding another layer of security in the event your security credentials are compromised or unauthorized access is granted.",
+                    ImpactStatement="",
+                    RemediationProcedure="Perform the steps below to enable MFA delete on an S3 bucket.Note:-You cannot enable MFA Delete using the AWS Management Console. You must use the AWS CLI or API.-You must use your 'root' account to enable MFA Delete on S3 buckets.**From Command line:**1. Run the s3api put-bucket-versioning command aws s3api put-bucket-versioning --profile my-root-profile --bucket Bucket_Name --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa arn:aws:iam::aws_account_id:mfa/root-account-mfa-device passcode",
+                    AuditProcedure="Perform the steps below to confirm MFA delete is configured on an S3 Bucket**From Console:**1. Login to the S3 console at `https://console.aws.amazon.com/s3/`2. Click the `Check` box next to the Bucket name you want to confirm3. In the window under `Properties`4. Confirm that Versioning is `Enabled`5. Confirm that MFA Delete is `Enabled`**From Command Line:**1. Run the `get-bucket-versioning aws s3api get-bucket-versioning --bucket my-bucket Output example:   Enabled Enabled\ If the Console or the CLI output does not show Versioning and MFA Delete `enabled` refer to the remediation below.",
+                    AdditionalInformation="",
+                    References="https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html#MultiFactorAuthenticationDelete:https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingMFADelete.html:https://aws.amazon.com/blogs/security/securing-access-to-aws-using-mfa-part-3/:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_lost-or-broken.html",
+                    DefaultValue="By default, MFA Delete is not enabled on S3 buckets.",
+                )
+            ],
+        ),
+        Compliance_Requirement(
+            Checks=[],
+            Id="2.1.4",
+            Description="Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive",
+            Attributes=[
+                CIS_Requirement_Attribute(
+                    Section="1.1 Control Plane Node Configuration Files",
+                    Profile="Level 1 - Master Node",
+                    AssessmentStatus="Automated",
+                    Description="Ensure that the controller manager pod specification file has permissions of `600` or more restrictive.",
+                    RationaleStatement="The controller manager pod specification file controls various parameters that set the behavior of the Controller Manager on the master node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.",
+                    ImpactStatement="",
+                    RemediationProcedure="Run the below command (based on the file location on your system) on the Control Plane node. For example,  ``` chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml ```",
+                    AuditProcedure="Run the below command (based on the file location on your system) on the Control Plane node. For example,  ``` stat -c %a /etc/kubernetes/manifests/kube-controller-manager.yaml ```  Verify that the permissions are `600` or more restrictive.",
+                    AdditionalInformation="",
+                    References="https://kubernetes.io/docs/admin/kube-apiserver/",
+                    DefaultValue="By default, the `kube-controller-manager.yaml` file has permissions of `640`.",
+                )
+            ],
+        ),
+    ],
+)
+
 MITRE_ATTACK_AWS_NAME = "mitre_attack_aws"
 MITRE_ATTACK_AWS = Compliance(
     Framework="MITRE-ATTACK",
diff --git a/tests/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports_test.py b/tests/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports_test.py
index 85c1fd3c3d..98bfe0907e 100644
--- a/tests/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports_test.py
+++ b/tests/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports_test.py
@@ -269,6 +269,7 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_all_ports:
                         == f"arn:{aws_provider.identity.partition}:ec2:{AWS_REGION_US_EAST_1}:{aws_provider.identity.account}:security-group/{default_sg_id}"
                     )
                     assert sg.resource_details == default_sg_name
+                    assert sg.check_metadata.Severity == "high"
                     assert sg.resource_tags == []
 
     @mock_aws
@@ -361,6 +362,7 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_all_ports:
             assert len(result) == 1
             assert result[0].status == "PASS"
             assert result[0].region == AWS_REGION_US_EAST_1
+            assert result[0].check_metadata.Severity == "critical"
 
     @mock_aws
     def test_set_failed_check_called_correctly(self):
@@ -409,7 +411,6 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_all_ports:
                 "prowler.providers.aws.lib.service.service.AWSService.set_failed_check"
             ) as mock_set_failed_check,
         ):
-
             from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import (
                 ec2_securitygroup_allow_ingress_from_internet_to_all_ports,
             )
diff --git a/tests/providers/aws/services/iam/lib/policy_test.py b/tests/providers/aws/services/iam/lib/policy_test.py
index bac84355ac..02e88739ec 100644
--- a/tests/providers/aws/services/iam/lib/policy_test.py
+++ b/tests/providers/aws/services/iam/lib/policy_test.py
@@ -3,9 +3,11 @@ from prowler.providers.aws.services.iam.lib.policy import (
     check_full_service_access,
     is_condition_block_restrictive,
     is_condition_block_restrictive_organization,
+    is_condition_block_restrictive_sns_endpoint,
     is_condition_restricting_from_private_ip,
     is_policy_public,
 )
+import pytest
 
 TRUSTED_AWS_ACCOUNT_NUMBER = "123456789012"
 NON_TRUSTED_AWS_ACCOUNT_NUMBER = "111222333444"
@@ -1442,6 +1444,39 @@ class Test_Policy:
         condition_statement = {"StringEquals": {"aws:PrincipalOrgID": ALL_ORGS}}
         assert not is_condition_block_restrictive_organization(condition_statement)
 
+    @pytest.mark.parametrize(
+        "condition_value,expected",
+        [
+            ("*@example.com", True),
+            ("https://events.pagerduty.com/integration//enqueue", True),
+            (
+                "arn:aws:sns:eu-west-2:123456789012:example-topic:995be20c-a7e3-44ca-8c18-77cb263d15e7",
+                True,
+            ),
+            ("*@*.com", False),
+            ("*@*", False),
+            ("*@example.*", False),
+            ("https://events.pagerduty.com/integration/*/enqueue", False),
+            ("arn:aws:sns:eu-west-2:123456789012:example-topic:*", False),
+            (
+                "arn:aws:sns:eu-west-2:*:example-topic:995be20c-a7e3-44ca-8c18-77cb263d15e7",
+                False,
+            ),
+        ],
+    )
+    def test_condition_parser_string_equals_sns_endpoint_str(
+        self, condition_value: str, expected: bool
+    ):
+        condition_statement = {"StringEquals": {"SNS:Endpoint": condition_value}}
+        assert (
+            is_condition_block_restrictive_sns_endpoint(condition_statement) == expected
+        )
+
+        condition_statement = {"StringLike": {"SNS:Endpoint": condition_value}}
+        assert (
+            is_condition_block_restrictive_sns_endpoint(condition_statement) == expected
+        )
+
     def test_policy_allows_cross_account_access_with_root_and_wildcard_principal(self):
         policy_allow_root_and_wildcard_principal = {
             "Statement": [
diff --git a/tests/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible_test.py b/tests/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible_test.py
index 81f2cc8bad..71aa6c4477 100644
--- a/tests/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible_test.py
+++ b/tests/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible_test.py
@@ -1,8 +1,10 @@
+from typing import Any, Dict
 from unittest import mock
 from uuid import uuid4
 
 from prowler.providers.aws.services.sns.sns_service import Topic
 from tests.providers.aws.utils import AWS_ACCOUNT_NUMBER, AWS_REGION_EU_WEST_1
+import pytest
 
 kms_key_id = str(uuid4())
 topic_name = "test-topic"
@@ -97,6 +99,20 @@ test_policy_restricted_principal_account_organization = {
 }
 
 
+def generate_policy_restricted_on_sns_endpoint(endpoint: str) -> Dict[str, Any]:
+    return {
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Principal": {"AWS": "*"},
+                "Action": ["sns:Publish"],
+                "Resource": f"arn:aws:sns:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:{topic_name}",
+                "Condition": {"StringEquals": {"SNS:Endpoint": endpoint}},
+            }
+        ]
+    }
+
+
 class Test_sns_topics_not_publicly_accessible:
     def test_no_topics(self):
         sns_client = mock.MagicMock
@@ -379,3 +395,94 @@ class Test_sns_topics_not_publicly_accessible:
             assert result[0].resource_arn == topic_arn
             assert result[0].region == AWS_REGION_EU_WEST_1
             assert result[0].resource_tags == []
+
+    @pytest.mark.parametrize(
+        "endpoint",
+        [
+            ("*@example.com"),
+            ("user@example.com"),
+            ("https://events.pagerduty.com/integration/987654321/enqueue"),
+            (
+                "arn:aws:sns:eu-west-2:123456789012:example-topic:995be20c-a7e3-44ca-8c18-77cb263d15e7"
+            ),
+        ],
+    )
+    def test_topic_public_with_sns_endpoint(self, endpoint: str):
+        sns_client = mock.MagicMock
+        sns_client.audited_account = AWS_ACCOUNT_NUMBER
+        sns_client.topics = []
+        sns_client.topics.append(
+            Topic(
+                arn=topic_arn,
+                name=topic_name,
+                policy=generate_policy_restricted_on_sns_endpoint(endpoint=endpoint),
+                region=AWS_REGION_EU_WEST_1,
+            )
+        )
+        sns_client.provider = mock.MagicMock()
+        sns_client.provider.organizations_metadata = mock.MagicMock()
+        sns_client.provider.organizations_metadata.organization_id = org_id
+        with mock.patch(
+            "prowler.providers.aws.services.sns.sns_service.SNS",
+            sns_client,
+        ):
+            from prowler.providers.aws.services.sns.sns_topics_not_publicly_accessible.sns_topics_not_publicly_accessible import (
+                sns_topics_not_publicly_accessible,
+            )
+
+            check = sns_topics_not_publicly_accessible()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"SNS topic {topic_name} is not public because its policy only allows access from an endpoint."
+            )
+            assert result[0].resource_id == topic_name
+            assert result[0].resource_arn == topic_arn
+            assert result[0].region == AWS_REGION_EU_WEST_1
+            assert result[0].resource_tags == []
+
+    @pytest.mark.parametrize(
+        "endpoint",
+        [
+            ("*@*"),
+            ("https://events.pagerduty.com/integration/*/enqueue"),
+            ("arn:aws:sns:eu-west-2:*:example-topic:*"),
+        ],
+    )
+    def test_topic_public_with_unrestricted_sns_endpoint(self, endpoint: str):
+        sns_client = mock.MagicMock
+        sns_client.audited_account = AWS_ACCOUNT_NUMBER
+        sns_client.topics = []
+        sns_client.topics.append(
+            Topic(
+                arn=topic_arn,
+                name=topic_name,
+                policy=generate_policy_restricted_on_sns_endpoint(endpoint=endpoint),
+                region=AWS_REGION_EU_WEST_1,
+            )
+        )
+        sns_client.provider = mock.MagicMock()
+        sns_client.provider.organizations_metadata = mock.MagicMock()
+        sns_client.provider.organizations_metadata.organization_id = org_id
+        with mock.patch(
+            "prowler.providers.aws.services.sns.sns_service.SNS",
+            sns_client,
+        ):
+            from prowler.providers.aws.services.sns.sns_topics_not_publicly_accessible.sns_topics_not_publicly_accessible import (
+                sns_topics_not_publicly_accessible,
+            )
+
+            check = sns_topics_not_publicly_accessible()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"SNS topic {topic_name} is public because its policy allows public access."
+            )
+            assert result[0].resource_id == topic_name
+            assert result[0].resource_arn == topic_arn
+            assert result[0].region == AWS_REGION_EU_WEST_1
+            assert result[0].resource_tags == []
diff --git a/tests/providers/github/services/organization/organization_members_mfa_required/organization_members_mfa_required_test.py b/tests/providers/github/services/organization/organization_members_mfa_required/organization_members_mfa_required_test.py
new file mode 100644
index 0000000000..823c0f294f
--- /dev/null
+++ b/tests/providers/github/services/organization/organization_members_mfa_required/organization_members_mfa_required_test.py
@@ -0,0 +1,100 @@
+from unittest import mock
+
+from prowler.providers.github.services.organization.organization_service import Org
+from tests.providers.github.github_fixtures import set_mocked_github_provider
+
+
+class Test_organization_members_mfa_required:
+    def test_no_organizations(self):
+        organization_client = mock.MagicMock
+        organization_client.organizations = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.organization.organization_members_mfa_required.organization_members_mfa_required.organization_client",
+                new=organization_client,
+            ),
+        ):
+            from prowler.providers.github.services.organization.organization_members_mfa_required.organization_members_mfa_required import (
+                organization_members_mfa_required,
+            )
+
+            check = organization_members_mfa_required()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_organization_mfa_disabled(self):
+        organization_client = mock.MagicMock
+        org_name = "test-organization"
+        organization_client.organizations = {
+            1: Org(
+                id=1,
+                name=org_name,
+                mfa_required=False,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.organization.organization_members_mfa_required.organization_members_mfa_required.organization_client",
+                new=organization_client,
+            ),
+        ):
+            from prowler.providers.github.services.organization.organization_members_mfa_required.organization_members_mfa_required import (
+                organization_members_mfa_required,
+            )
+
+            check = organization_members_mfa_required()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "test-organization"
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Organization {org_name} does not require members to have two-factor authentication enabled."
+            )
+
+    def test_one_organization_securitymd(self):
+        organization_client = mock.MagicMock
+        org_name = "test-organization"
+        organization_client.organizations = {
+            1: Org(
+                id=1,
+                name=org_name,
+                mfa_required=True,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.organization.organization_members_mfa_required.organization_members_mfa_required.organization_client",
+                new=organization_client,
+            ),
+        ):
+            from prowler.providers.github.services.organization.organization_members_mfa_required.organization_members_mfa_required import (
+                organization_members_mfa_required,
+            )
+
+            check = organization_members_mfa_required()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "test-organization"
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Organization {org_name} does require members to have two-factor authentication enabled."
+            )
diff --git a/tests/providers/github/services/organization/organization_service_test.py b/tests/providers/github/services/organization/organization_service_test.py
new file mode 100644
index 0000000000..7720841698
--- /dev/null
+++ b/tests/providers/github/services/organization/organization_service_test.py
@@ -0,0 +1,37 @@
+from unittest.mock import patch
+
+from prowler.providers.github.services.organization.organization_service import (
+    Org,
+    Organization,
+)
+from tests.providers.github.github_fixtures import set_mocked_github_provider
+
+
+def mock_list_organizations(_):
+    return {
+        1: Org(
+            id=1,
+            name="test-organization",
+            mfa_required=True,
+        ),
+    }
+
+
+@patch(
+    "prowler.providers.github.services.organization.organization_service.Organization._list_organizations",
+    new=mock_list_organizations,
+)
+class Test_Repository_Service:
+    def test_get_client(self):
+        repository_service = Organization(set_mocked_github_provider())
+        assert repository_service.clients[0].__class__.__name__ == "Github"
+
+    def test_get_service(self):
+        repository_service = Organization(set_mocked_github_provider())
+        assert repository_service.__class__.__name__ == "Organization"
+
+    def test_list_organizations(self):
+        repository_service = Organization(set_mocked_github_provider())
+        assert len(repository_service.organizations) == 1
+        assert repository_service.organizations[1].name == "test-organization"
+        assert repository_service.organizations[1].mfa_required
diff --git a/tests/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled_test.py b/tests/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled_test.py
new file mode 100644
index 0000000000..fc9a5c3ddd
--- /dev/null
+++ b/tests/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled_test.py
@@ -0,0 +1,108 @@
+from unittest import mock
+
+from prowler.providers.github.services.repository.repository_service import Repo
+from tests.providers.github.github_fixtures import set_mocked_github_provider
+
+
+class Test_repository_branch_delete_on_merge_enabled_test:
+    def test_no_repositories(self):
+        repository_client = mock.MagicMock
+        repository_client.repositories = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_branch_delete_on_merge_enabled.repository_branch_delete_on_merge_enabled.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_branch_delete_on_merge_enabled.repository_branch_delete_on_merge_enabled import (
+                repository_branch_delete_on_merge_enabled,
+            )
+
+            check = repository_branch_delete_on_merge_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_branch_deletion_disabled(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                default_branch="main",
+                private=False,
+                securitymd=False,
+                delete_branch_on_merge=False,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_branch_delete_on_merge_enabled.repository_branch_delete_on_merge_enabled.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_branch_delete_on_merge_enabled.repository_branch_delete_on_merge_enabled import (
+                repository_branch_delete_on_merge_enabled,
+            )
+
+            check = repository_branch_delete_on_merge_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does not delete branches on merge."
+            )
+
+    def test_branch_deletion_enabled(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                default_branch="main",
+                private=False,
+                securitymd=True,
+                delete_branch_on_merge=True,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_branch_delete_on_merge_enabled.repository_branch_delete_on_merge_enabled.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_branch_delete_on_merge_enabled.repository_branch_delete_on_merge_enabled import (
+                repository_branch_delete_on_merge_enabled,
+            )
+
+            check = repository_branch_delete_on_merge_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does delete branches on merge."
+            )
diff --git a/tests/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled_test.py b/tests/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled_test.py
new file mode 100644
index 0000000000..825e4bdc6e
--- /dev/null
+++ b/tests/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled_test.py
@@ -0,0 +1,110 @@
+from unittest import mock
+
+from prowler.providers.github.services.repository.repository_service import Repo
+from tests.providers.github.github_fixtures import set_mocked_github_provider
+
+
+class Test_repository_default_branch_deletion_disabled_test:
+    def test_no_repositories(self):
+        repository_client = mock.MagicMock
+        repository_client.repositories = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_deletion_disabled.repository_default_branch_deletion_disabled.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_deletion_disabled.repository_default_branch_deletion_disabled import (
+                repository_default_branch_deletion_disabled,
+            )
+
+            check = repository_default_branch_deletion_disabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_allow_branch_deletion_enabled(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        default_branch = "main"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                default_branch=default_branch,
+                default_branch_deletion=True,
+                private=False,
+                securitymd=False,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_deletion_disabled.repository_default_branch_deletion_disabled.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_deletion_disabled.repository_default_branch_deletion_disabled import (
+                repository_default_branch_deletion_disabled,
+            )
+
+            check = repository_default_branch_deletion_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does allow default branch deletion."
+            )
+
+    def test_allow_branch_deletion_disabled(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        default_branch = "main"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                private=False,
+                default_branch=default_branch,
+                default_branch_deletion=False,
+                securitymd=True,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_deletion_disabled.repository_default_branch_deletion_disabled.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_deletion_disabled.repository_default_branch_deletion_disabled import (
+                repository_default_branch_deletion_disabled,
+            )
+
+            check = repository_default_branch_deletion_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does deny default branch deletion."
+            )
diff --git a/tests/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push_test.py b/tests/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push_test.py
new file mode 100644
index 0000000000..a9da35d0fe
--- /dev/null
+++ b/tests/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push_test.py
@@ -0,0 +1,110 @@
+from unittest import mock
+
+from prowler.providers.github.services.repository.repository_service import Repo
+from tests.providers.github.github_fixtures import set_mocked_github_provider
+
+
+class Test_repository_default_branch_disallows_force_push_test:
+    def test_no_repositories(self):
+        repository_client = mock.MagicMock
+        repository_client.repositories = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_disallows_force_push.repository_default_branch_disallows_force_push.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_disallows_force_push.repository_default_branch_disallows_force_push import (
+                repository_default_branch_disallows_force_push,
+            )
+
+            check = repository_default_branch_disallows_force_push()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_allow_force_push_enabled(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        default_branch = "main"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                default_branch=default_branch,
+                allow_force_pushes=True,
+                private=False,
+                securitymd=False,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_disallows_force_push.repository_default_branch_disallows_force_push.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_disallows_force_push.repository_default_branch_disallows_force_push import (
+                repository_default_branch_disallows_force_push,
+            )
+
+            check = repository_default_branch_disallows_force_push()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does allow force push."
+            )
+
+    def test_allow_force_push_disabled(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        default_branch = "main"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                private=False,
+                default_branch=default_branch,
+                allow_force_pushes=False,
+                securitymd=True,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_disallows_force_push.repository_default_branch_disallows_force_push.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_disallows_force_push.repository_default_branch_disallows_force_push import (
+                repository_default_branch_disallows_force_push,
+            )
+
+            check = repository_default_branch_disallows_force_push()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does deny force push."
+            )
diff --git a/tests/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins_test.py b/tests/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins_test.py
new file mode 100644
index 0000000000..f85bbdced9
--- /dev/null
+++ b/tests/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins_test.py
@@ -0,0 +1,110 @@
+from unittest import mock
+
+from prowler.providers.github.services.repository.repository_service import Repo
+from tests.providers.github.github_fixtures import set_mocked_github_provider
+
+
+class Test_repository_default_branch_protection_applies_to_admins_test:
+    def test_no_repositories(self):
+        repository_client = mock.MagicMock
+        repository_client.repositories = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_protection_applies_to_admins.repository_default_branch_protection_applies_to_admins.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_protection_applies_to_admins.repository_default_branch_protection_applies_to_admins import (
+                repository_default_branch_protection_applies_to_admins,
+            )
+
+            check = repository_default_branch_protection_applies_to_admins()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_enforce_status_checks_disabled(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        default_branch = "main"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                default_branch=default_branch,
+                private=False,
+                securitymd=False,
+                enforce_admins=False,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_protection_applies_to_admins.repository_default_branch_protection_applies_to_admins.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_protection_applies_to_admins.repository_default_branch_protection_applies_to_admins import (
+                repository_default_branch_protection_applies_to_admins,
+            )
+
+            check = repository_default_branch_protection_applies_to_admins()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does not enforce administrators to be subject to the same branch protection rules as other users."
+            )
+
+    def test_enforce_status_checks_enabled(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        default_branch = "main"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                private=False,
+                default_branch=default_branch,
+                enforce_admins=True,
+                securitymd=True,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_protection_applies_to_admins.repository_default_branch_protection_applies_to_admins.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_protection_applies_to_admins.repository_default_branch_protection_applies_to_admins import (
+                repository_default_branch_protection_applies_to_admins,
+            )
+
+            check = repository_default_branch_protection_applies_to_admins()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does enforce administrators to be subject to the same branch protection rules as other users."
+            )
diff --git a/tests/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled_test.py b/tests/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled_test.py
new file mode 100644
index 0000000000..3723863298
--- /dev/null
+++ b/tests/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled_test.py
@@ -0,0 +1,110 @@
+from unittest import mock
+
+from prowler.providers.github.services.repository.repository_service import Repo
+from tests.providers.github.github_fixtures import set_mocked_github_provider
+
+
+class Test_repository_default_branch_protection_enabled_test:
+    def test_no_repositories(self):
+        repository_client = mock.MagicMock
+        repository_client.repositories = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_protection_enabled.repository_default_branch_protection_enabled.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_protection_enabled.repository_default_branch_protection_enabled import (
+                repository_default_branch_protection_enabled,
+            )
+
+            check = repository_default_branch_protection_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_without_default_branch_protection(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        default_branch = "main"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                default_branch=default_branch,
+                private=False,
+                default_branch_protection=False,
+                securitymd=False,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_protection_enabled.repository_default_branch_protection_enabled.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_protection_enabled.repository_default_branch_protection_enabled import (
+                repository_default_branch_protection_enabled,
+            )
+
+            check = repository_default_branch_protection_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does not enforce branch protection on default branch ({default_branch})."
+            )
+
+    def test_default_branch_protection(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        default_branch = "main"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                private=False,
+                default_branch=default_branch,
+                default_branch_protection=True,
+                securitymd=True,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_protection_enabled.repository_default_branch_protection_enabled.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_protection_enabled.repository_default_branch_protection_enabled import (
+                repository_default_branch_protection_enabled,
+            )
+
+            check = repository_default_branch_protection_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does enforce branch protection on default branch ({default_branch})."
+            )
diff --git a/tests/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution_test.py b/tests/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution_test.py
new file mode 100644
index 0000000000..2fe4b1dbd5
--- /dev/null
+++ b/tests/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution_test.py
@@ -0,0 +1,110 @@
+from unittest import mock
+
+from prowler.providers.github.services.repository.repository_service import Repo
+from tests.providers.github.github_fixtures import set_mocked_github_provider
+
+
+class Test_repository_default_branch_requires_conversation_resolution_test:
+    def test_no_repositories(self):
+        repository_client = mock.MagicMock
+        repository_client.repositories = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_requires_conversation_resolution.repository_default_branch_requires_conversation_resolution.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_requires_conversation_resolution.repository_default_branch_requires_conversation_resolution import (
+                repository_default_branch_requires_conversation_resolution,
+            )
+
+            check = repository_default_branch_requires_conversation_resolution()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_conversation_resolution_disabled(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        default_branch = "main"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                default_branch=default_branch,
+                conversation_resolution=False,
+                private=False,
+                securitymd=False,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_requires_conversation_resolution.repository_default_branch_requires_conversation_resolution.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_requires_conversation_resolution.repository_default_branch_requires_conversation_resolution import (
+                repository_default_branch_requires_conversation_resolution,
+            )
+
+            check = repository_default_branch_requires_conversation_resolution()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does not require conversation resolution."
+            )
+
+    def test_conversation_resolution_enabled(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        default_branch = "main"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                private=False,
+                default_branch=default_branch,
+                conversation_resolution=True,
+                securitymd=True,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_requires_conversation_resolution.repository_default_branch_requires_conversation_resolution.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_requires_conversation_resolution.repository_default_branch_requires_conversation_resolution import (
+                repository_default_branch_requires_conversation_resolution,
+            )
+
+            check = repository_default_branch_requires_conversation_resolution()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does require conversation resolution."
+            )
diff --git a/tests/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history_test.py b/tests/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history_test.py
new file mode 100644
index 0000000000..5759697999
--- /dev/null
+++ b/tests/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history_test.py
@@ -0,0 +1,110 @@
+from unittest import mock
+
+from prowler.providers.github.services.repository.repository_service import Repo
+from tests.providers.github.github_fixtures import set_mocked_github_provider
+
+
+class Test_repository_default_branch_requires_linear_history_test:
+    def test_no_repositories(self):
+        repository_client = mock.MagicMock
+        repository_client.repositories = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_requires_linear_history.repository_default_branch_requires_linear_history.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_requires_linear_history.repository_default_branch_requires_linear_history import (
+                repository_default_branch_requires_linear_history,
+            )
+
+            check = repository_default_branch_requires_linear_history()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_linear_history_disabled(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        default_branch = "main"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                default_branch=default_branch,
+                required_linear_history=False,
+                private=False,
+                securitymd=False,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_requires_linear_history.repository_default_branch_requires_linear_history.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_requires_linear_history.repository_default_branch_requires_linear_history import (
+                repository_default_branch_requires_linear_history,
+            )
+
+            check = repository_default_branch_requires_linear_history()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does not require linear history on default branch ({default_branch})."
+            )
+
+    def test_linear_history_enabled(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        default_branch = "main"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                private=False,
+                default_branch=default_branch,
+                required_linear_history=True,
+                securitymd=True,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_requires_linear_history.repository_default_branch_requires_linear_history.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_requires_linear_history.repository_default_branch_requires_linear_history import (
+                repository_default_branch_requires_linear_history,
+            )
+
+            check = repository_default_branch_requires_linear_history()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does require linear history on default branch ({default_branch})."
+            )
diff --git a/tests/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals_test.py b/tests/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals_test.py
new file mode 100644
index 0000000000..be8905fc7d
--- /dev/null
+++ b/tests/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals_test.py
@@ -0,0 +1,154 @@
+from unittest import mock
+
+from prowler.providers.github.services.repository.repository_service import Repo
+from tests.providers.github.github_fixtures import set_mocked_github_provider
+
+
+class Test_repository_default_branch_requires_multiple_approvals:
+    def test_no_repositories(self):
+        repository_client = mock.MagicMock
+        repository_client.repositories = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_requires_multiple_approvals.repository_default_branch_requires_multiple_approvals.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_requires_multiple_approvals.repository_default_branch_requires_multiple_approvals import (
+                repository_default_branch_requires_multiple_approvals,
+            )
+
+            check = repository_default_branch_requires_multiple_approvals()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_repository_no_require_pull_request(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                default_branch_protection=False,
+                default_branch="main",
+                private=False,
+                securitymd=False,
+                require_pull_request=False,
+                approval_count=0,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_requires_multiple_approvals.repository_default_branch_requires_multiple_approvals.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_requires_multiple_approvals.repository_default_branch_requires_multiple_approvals import (
+                repository_default_branch_requires_multiple_approvals,
+            )
+
+            check = repository_default_branch_requires_multiple_approvals()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does not enforce at least 2 approvals for code changes."
+            )
+
+    def test_repository_no_approvals(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                default_branch_protection=False,
+                default_branch="master",
+                private=False,
+                securitymd=False,
+                require_pull_request=True,
+                approval_count=0,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_requires_multiple_approvals.repository_default_branch_requires_multiple_approvals.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_requires_multiple_approvals.repository_default_branch_requires_multiple_approvals import (
+                repository_default_branch_requires_multiple_approvals,
+            )
+
+            check = repository_default_branch_requires_multiple_approvals()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does not enforce at least 2 approvals for code changes."
+            )
+
+    def test_repository_two_approvals(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                default_branch_protection=True,
+                default_branch="master",
+                private=False,
+                securitymd=True,
+                require_pull_request=True,
+                approval_count=2,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_requires_multiple_approvals.repository_default_branch_requires_multiple_approvals.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_requires_multiple_approvals.repository_default_branch_requires_multiple_approvals import (
+                repository_default_branch_requires_multiple_approvals,
+            )
+
+            check = repository_default_branch_requires_multiple_approvals()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does enforce at least 2 approvals for code changes."
+            )
diff --git a/tests/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required_test.py b/tests/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required_test.py
new file mode 100644
index 0000000000..0da7d9425f
--- /dev/null
+++ b/tests/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required_test.py
@@ -0,0 +1,110 @@
+from unittest import mock
+
+from prowler.providers.github.services.repository.repository_service import Repo
+from tests.providers.github.github_fixtures import set_mocked_github_provider
+
+
+class Test_repository_default_branch_status_checks_required_test:
+    def test_no_repositories(self):
+        repository_client = mock.MagicMock
+        repository_client.repositories = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_status_checks_required.repository_default_branch_status_checks_required.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_status_checks_required.repository_default_branch_status_checks_required import (
+                repository_default_branch_status_checks_required,
+            )
+
+            check = repository_default_branch_status_checks_required()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_enforce_status_checks_disabled(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        default_branch = "main"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                default_branch=default_branch,
+                status_checks=False,
+                private=False,
+                securitymd=False,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_status_checks_required.repository_default_branch_status_checks_required.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_status_checks_required.repository_default_branch_status_checks_required import (
+                repository_default_branch_status_checks_required,
+            )
+
+            check = repository_default_branch_status_checks_required()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does not enforce status checks."
+            )
+
+    def test_enforce_status_checks_enabled(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        default_branch = "main"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                private=False,
+                default_branch=default_branch,
+                status_checks=True,
+                securitymd=True,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_default_branch_status_checks_required.repository_default_branch_status_checks_required.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_default_branch_status_checks_required.repository_default_branch_status_checks_required import (
+                repository_default_branch_status_checks_required,
+            )
+
+            check = repository_default_branch_status_checks_required()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does enforce status checks."
+            )
diff --git a/tests/providers/github/services/repository/repository_public_has_securitymd_file/repository_public_has_securitymd_file_test.py b/tests/providers/github/services/repository/repository_public_has_securitymd_file/repository_public_has_securitymd_file_test.py
index ccbf02c075..776d557252 100644
--- a/tests/providers/github/services/repository/repository_public_has_securitymd_file/repository_public_has_securitymd_file_test.py
+++ b/tests/providers/github/services/repository/repository_public_has_securitymd_file/repository_public_has_securitymd_file_test.py
@@ -35,8 +35,11 @@ class Test_repository_public_has_securitymd_file_test:
                 id=1,
                 name=repo_name,
                 full_name="account-name/repo1",
+                default_branch="main",
                 private=False,
                 securitymd=False,
+                require_pull_request=False,
+                approval_count=0,
             ),
         }
 
@@ -73,8 +76,11 @@ class Test_repository_public_has_securitymd_file_test:
                 id=1,
                 name=repo_name,
                 full_name="account-name/repo1",
+                default_branch="main",
                 private=False,
                 securitymd=True,
+                require_pull_request=False,
+                approval_count=0,
             ),
         }
 
diff --git a/tests/providers/github/services/repository/repository_service_test.py b/tests/providers/github/services/repository/repository_service_test.py
index a375b5c62c..bcc3b19791 100644
--- a/tests/providers/github/services/repository/repository_service_test.py
+++ b/tests/providers/github/services/repository/repository_service_test.py
@@ -13,8 +13,19 @@ def mock_list_repositories(_):
             id=1,
             name="repo1",
             full_name="account-name/repo1",
+            default_branch_protection=True,
+            default_branch="main",
             private=False,
-            securitymd=False,
+            securitymd=True,
+            require_pull_request=True,
+            required_linear_history=True,
+            allow_force_pushes=True,
+            default_branch_deletion=True,
+            status_checks=True,
+            approval_count=2,
+            enforce_admins=True,
+            delete_branch_on_merge=True,
+            conversation_resolution=True,
         ),
     }
 
@@ -38,4 +49,14 @@ class Test_Repository_Service:
         assert repository_service.repositories[1].name == "repo1"
         assert repository_service.repositories[1].full_name == "account-name/repo1"
         assert repository_service.repositories[1].private is False
-        assert repository_service.repositories[1].securitymd is False
+        assert repository_service.repositories[1].default_branch == "main"
+        assert repository_service.repositories[1].securitymd
+        assert repository_service.repositories[1].required_linear_history
+        assert repository_service.repositories[1].require_pull_request
+        assert repository_service.repositories[1].allow_force_pushes
+        assert repository_service.repositories[1].default_branch_deletion
+        assert repository_service.repositories[1].status_checks
+        assert repository_service.repositories[1].enforce_admins
+        assert repository_service.repositories[1].delete_branch_on_merge
+        assert repository_service.repositories[1].conversation_resolution
+        assert repository_service.repositories[1].approval_count == 2
diff --git a/tests/providers/m365/lib/powershell/m365_powershell_test.py b/tests/providers/m365/lib/powershell/m365_powershell_test.py
index 66094aa581..b841602914 100644
--- a/tests/providers/m365/lib/powershell/m365_powershell_test.py
+++ b/tests/providers/m365/lib/powershell/m365_powershell_test.py
@@ -7,7 +7,7 @@ from prowler.providers.m365.exceptions.exceptions import (
     M365UserNotBelongingToTenantError,
 )
 from prowler.providers.m365.lib.powershell.m365_powershell import M365PowerShell
-from prowler.providers.m365.models import M365Credentials
+from prowler.providers.m365.models import M365Credentials, M365IdentityInfo
 
 
 class Testm365PowerShell:
@@ -16,9 +16,17 @@ class Testm365PowerShell:
         mock_process = MagicMock()
         mock_popen.return_value = mock_process
         credentials = M365Credentials(user="test@example.com", passwd="test_password")
+        identity = M365IdentityInfo(
+            identity_id="test_id",
+            identity_type="User",
+            tenant_id="test_tenant",
+            tenant_domain="example.com",
+            tenant_domains=["example.com"],
+            location="test_location",
+        )
 
         with patch.object(M365PowerShell, "init_credential") as mock_init_credential:
-            session = M365PowerShell(credentials)
+            session = M365PowerShell(credentials, identity)
 
             mock_popen.assert_called_once()
             mock_init_credential.assert_called_once_with(credentials)
@@ -29,7 +37,15 @@ class Testm365PowerShell:
     @patch("subprocess.Popen")
     def test_sanitize(self, _):
         credentials = M365Credentials(user="test@example.com", passwd="test_password")
-        session = M365PowerShell(credentials)
+        identity = M365IdentityInfo(
+            identity_id="test_id",
+            identity_type="User",
+            tenant_id="test_tenant",
+            tenant_domain="example.com",
+            tenant_domains=["example.com"],
+            location="test_location",
+        )
+        session = M365PowerShell(credentials, identity)
 
         test_cases = [
             ("test@example.com", "test@example.com"),
@@ -63,7 +79,15 @@ class Testm365PowerShell:
             client_secret="test_client_secret",
             tenant_id="test_tenant_id",
         )
-        session = M365PowerShell(credentials)
+        identity = M365IdentityInfo(
+            identity_id="test_id",
+            identity_type="User",
+            tenant_id="test_tenant",
+            tenant_domain="example.com",
+            tenant_domains=["example.com"],
+            location="test_location",
+        )
+        session = M365PowerShell(credentials, identity)
 
         session.execute = MagicMock()
 
@@ -95,9 +119,16 @@ class Testm365PowerShell:
             client_id="test_client_id",
             client_secret="test_client_secret",
             tenant_id="test_tenant_id",
-            provider_id="contoso.onmicrosoft.com",
         )
-        session = M365PowerShell(credentials)
+        identity = M365IdentityInfo(
+            identity_id="test_id",
+            identity_type="User",
+            tenant_id="test_tenant",
+            tenant_domain="contoso.onmicrosoft.com",
+            tenant_domains=["contoso.onmicrosoft.com"],
+            location="test_location",
+        )
+        session = M365PowerShell(credentials, identity)
 
         # Mock read_output to return the decrypted password
         session.read_output = MagicMock(return_value="decrypted_password")
@@ -150,9 +181,16 @@ class Testm365PowerShell:
             client_id="test_client_id",
             client_secret="test_client_secret",
             tenant_id="test_tenant_id",
-            provider_id="contoso.onmicrosoft.com",
         )
-        session = M365PowerShell(credentials)
+        identity = M365IdentityInfo(
+            identity_id="test_id",
+            identity_type="User",
+            tenant_id="test_tenant",
+            tenant_domain="contoso.onmicrosoft.com",
+            tenant_domains=["contoso.onmicrosoft.com"],
+            location="test_location",
+        )
+        session = M365PowerShell(credentials, identity)
 
         # Mock the execute method to return the decrypted password
         def mock_execute(command, *args, **kwargs):
@@ -168,20 +206,15 @@ class Testm365PowerShell:
             session.test_credentials(credentials)
 
         assert exception.type == M365UserNotBelongingToTenantError
-        assert "The provided M365 User does not belong to the specified tenant." in str(
-            exception.value
+        assert (
+            "The user domain otherdomain.com does not match any of the tenant domains: contoso.onmicrosoft.com"
+            in str(exception.value)
         )
 
-        mock_msal.assert_called_once_with(
-            client_id="test_client_id",
-            client_credential="test_client_secret",
-            authority="https://login.microsoftonline.com/test_tenant_id",
-        )
-        mock_msal_instance.acquire_token_by_username_password.assert_called_once_with(
-            username="user@otherdomain.com",
-            password="decrypted_password",
-            scopes=["https://graph.microsoft.com/.default"],
-        )
+        # Verify MSAL was not called since domain validation failed first
+        mock_msal.assert_not_called()
+        mock_msal_instance.acquire_token_by_username_password.assert_not_called()
+
         session.close()
 
     @patch("subprocess.Popen")
@@ -199,9 +232,16 @@ class Testm365PowerShell:
             client_id="test_client_id",
             client_secret="test_client_secret",
             tenant_id="test_tenant_id",
-            provider_id="contoso.onmicrosoft.com",
         )
-        session = M365PowerShell(credentials)
+        identity = M365IdentityInfo(
+            identity_id="test_id",
+            identity_type="User",
+            tenant_id="test_tenant",
+            tenant_domain="contoso.onmicrosoft.com",
+            tenant_domains=["contoso.onmicrosoft.com"],
+            location="test_location",
+        )
+        session = M365PowerShell(credentials, identity)
 
         # Mock the execute method to return the decrypted password
         def mock_execute(command, *args, **kwargs):
@@ -231,7 +271,15 @@ class Testm365PowerShell:
     @patch("subprocess.Popen")
     def test_remove_ansi(self, mock_popen):
         credentials = M365Credentials(user="test@example.com", passwd="test_password")
-        session = M365PowerShell(credentials)
+        identity = M365IdentityInfo(
+            identity_id="test_id",
+            identity_type="User",
+            tenant_id="test_tenant",
+            tenant_domain="example.com",
+            tenant_domains=["example.com"],
+            location="test_location",
+        )
+        session = M365PowerShell(credentials, identity)
 
         test_cases = [
             ("\x1b[32mSuccess\x1b[0m", "Success"),
@@ -250,7 +298,15 @@ class Testm365PowerShell:
         mock_process = MagicMock()
         mock_popen.return_value = mock_process
         credentials = M365Credentials(user="test@example.com", passwd="test_password")
-        session = M365PowerShell(credentials)
+        identity = M365IdentityInfo(
+            identity_id="test_id",
+            identity_type="User",
+            tenant_id="test_tenant",
+            tenant_domain="example.com",
+            tenant_domains=["example.com"],
+            location="test_location",
+        )
+        session = M365PowerShell(credentials, identity)
         command = "Get-Command"
         expected_output = {"Name": "Get-Command"}
 
@@ -261,18 +317,19 @@ class Testm365PowerShell:
 
     @patch("subprocess.Popen")
     def test_read_output(self, mock_popen):
-        """Test the read_output method with various scenarios:
-        - Normal stdout output
-        - Error in stderr
-        - Timeout in stdout
-        - Empty output
-        - Empty queue handling
-        """
-        # Setup
+        """Test the read_output method with various scenarios"""
         mock_process = MagicMock()
         mock_popen.return_value = mock_process
         credentials = M365Credentials(user="test@example.com", passwd="test_password")
-        session = M365PowerShell(credentials)
+        identity = M365IdentityInfo(
+            identity_id="test_id",
+            identity_type="User",
+            tenant_id="test_tenant",
+            tenant_domain="example.com",
+            tenant_domains=["example.com"],
+            location="test_location",
+        )
+        session = M365PowerShell(credentials, identity)
 
         # Test 1: Normal stdout output
         mock_process.stdout.readline.side_effect = [
@@ -304,95 +361,6 @@ class Testm365PowerShell:
         result = session.read_output(timeout=0.1, default="timeout")
         assert result == "timeout"
 
-        # Test 4: Empty output
-        mock_process.stdout.readline.side_effect = [f"{session.END}\n"]
-        mock_process.stderr.readline.return_value = f"Write-Error: {session.END}\n"
-        result = session.read_output()
-        assert result == ""
-
-        # Test 5: Empty queue handling
-        mock_process.stdout.readline.side_effect = []  # No output at all
-        mock_process.stderr.readline.return_value = f"Write-Error: {session.END}\n"
-        result = session.read_output(timeout=0.1, default="empty_queue")
-        assert result == "empty_queue"
-
-        # Test 6: Empty error queue handling
-        mock_process.stdout.readline.side_effect = ["test output\n", f"{session.END}\n"]
-        mock_process.stderr.readline.side_effect = []  # No error output
-        with patch("prowler.lib.logger.logger.error") as mock_error:
-            result = session.read_output()
-            assert result == "test output"
-            mock_error.assert_not_called()
-
-        # Test 7: Both queues empty
-        mock_process.stdout.readline.side_effect = []  # No output
-        mock_process.stderr.readline.side_effect = []  # No error output
-        result = session.read_output(timeout=0.1, default="both_empty")
-        assert result == "both_empty"
-
-        session.close()
-
-    @patch("subprocess.Popen")
-    def test_read_output_queue_empty(self, mock_popen):
-        """Test read_output when both queues are empty"""
-        mock_process = MagicMock()
-        mock_popen.return_value = mock_process
-        credentials = M365Credentials(user="test@example.com", passwd="test_password")
-        session = M365PowerShell(credentials)
-
-        # Mock process to return empty queues
-        mock_process.stdout.readline.side_effect = []  # No output
-        mock_process.stderr.readline.side_effect = []  # No error output
-
-        # Test with default value
-        result = session.read_output(timeout=0.1, default="empty_queue")
-        assert result == "empty_queue"
-
-        # Test without default value
-        result = session.read_output(timeout=0.1)
-        assert result == ""
-
-        session.close()
-
-    @patch("subprocess.Popen")
-    def test_read_output_error_queue_empty(self, mock_popen):
-        """Test read_output when error queue is empty but stdout has content"""
-        mock_process = MagicMock()
-        mock_popen.return_value = mock_process
-        credentials = M365Credentials(user="test@example.com", passwd="test_password")
-        session = M365PowerShell(credentials)
-
-        # Mock process to return content in stdout but empty stderr
-        mock_process.stdout.readline.side_effect = ["test output\n", f"{session.END}\n"]
-        mock_process.stderr.readline.side_effect = []  # No error output
-
-        with patch("prowler.lib.logger.logger.error") as mock_error:
-            result = session.read_output()
-            assert result == "test output"
-            mock_error.assert_not_called()
-
-        session.close()
-
-    @patch("subprocess.Popen")
-    def test_read_output_result_queue_empty(self, mock_popen):
-        """Test read_output when result queue is empty but stderr has content"""
-        mock_process = MagicMock()
-        mock_popen.return_value = mock_process
-        credentials = M365Credentials(user="test@example.com", passwd="test_password")
-        session = M365PowerShell(credentials)
-
-        # Mock process to return empty stdout but content in stderr
-        mock_process.stdout.readline.side_effect = []  # No output
-        mock_process.stderr.readline.side_effect = [
-            "Error message\n",
-            f"Write-Error: {session.END}\n",
-        ]
-
-        with patch("prowler.lib.logger.logger.error") as mock_error:
-            result = session.read_output(timeout=0.1, default="default")
-            assert result == "default"
-            mock_error.assert_called_once_with("PowerShell error output: Error message")
-
         session.close()
 
     @patch("subprocess.Popen")
@@ -400,7 +368,15 @@ class Testm365PowerShell:
         mock_process = MagicMock()
         mock_popen.return_value = mock_process
         credentials = M365Credentials(user="test@example.com", passwd="test_password")
-        session = M365PowerShell(credentials)
+        identity = M365IdentityInfo(
+            identity_id="test_id",
+            identity_type="User",
+            tenant_id="test_tenant",
+            tenant_domain="example.com",
+            tenant_domains=["example.com"],
+            location="test_location",
+        )
+        session = M365PowerShell(credentials, identity)
 
         test_cases = [
             ('{"key": "value"}', {"key": "value"}),
@@ -425,7 +401,15 @@ class Testm365PowerShell:
         mock_process = MagicMock()
         mock_popen.return_value = mock_process
         credentials = M365Credentials(user="test@example.com", passwd="test_password")
-        session = M365PowerShell(credentials)
+        identity = M365IdentityInfo(
+            identity_id="test_id",
+            identity_type="User",
+            tenant_id="test_tenant",
+            tenant_domain="example.com",
+            tenant_domains=["example.com"],
+            location="test_location",
+        )
+        session = M365PowerShell(credentials, identity)
 
         session.close()
 
diff --git a/tests/providers/m365/m365_provider_test.py b/tests/providers/m365/m365_provider_test.py
index 1d8c0759e6..2f30efabde 100644
--- a/tests/providers/m365/m365_provider_test.py
+++ b/tests/providers/m365/m365_provider_test.py
@@ -286,6 +286,17 @@ class TestM365Provider:
             patch(
                 "prowler.providers.m365.m365_provider.GraphServiceClient"
             ) as mock_graph_client,
+            patch(
+                "prowler.providers.m365.m365_provider.M365Provider.setup_identity",
+                return_value=M365IdentityInfo(
+                    identity_id=IDENTITY_ID,
+                    identity_type="User",
+                    tenant_id=TENANT_ID,
+                    tenant_domain=DOMAIN,
+                    tenant_domains=["test.onmicrosoft.com"],
+                    location=LOCATION,
+                ),
+            ),
         ):
             # Mock the return value of DefaultAzureCredential
             mock_credentials = MagicMock()
@@ -298,7 +309,7 @@ class TestM365Provider:
             mock_session = MagicMock()
             mock_setup_session.return_value = mock_session
 
-            # Mock GraphServiceClient to avoid real API calls
+            # Mock GraphServiceClient
             mock_client = MagicMock()
             mock_graph_client.return_value = mock_client
 
@@ -307,6 +318,7 @@ class TestM365Provider:
                 tenant_id=str(uuid4()),
                 region="M365Global",
                 raise_on_exception=False,
+                provider_id="test.onmicrosoft.com",
             )
 
             assert isinstance(test_connection, Connection)
@@ -321,6 +333,17 @@ class TestM365Provider:
             patch(
                 "prowler.providers.m365.m365_provider.M365Provider.validate_static_credentials"
             ) as mock_validate_static_credentials,
+            patch(
+                "prowler.providers.m365.m365_provider.M365Provider.setup_identity",
+                return_value=M365IdentityInfo(
+                    identity_id=IDENTITY_ID,
+                    identity_type="User",
+                    tenant_id=TENANT_ID,
+                    tenant_domain=DOMAIN,
+                    tenant_domains=["test.onmicrosoft.com"],
+                    location=LOCATION,
+                ),
+            ),
         ):
             # Mock setup_session to return a mocked session object
             mock_session = MagicMock()
@@ -335,6 +358,7 @@ class TestM365Provider:
                 raise_on_exception=False,
                 client_id=str(uuid4()),
                 client_secret=str(uuid4()),
+                provider_id="test.onmicrosoft.com",
             )
 
             assert isinstance(test_connection, Connection)
@@ -458,9 +482,15 @@ class TestM365Provider:
             result = M365Provider.setup_powershell(
                 env_auth=False,
                 m365_credentials=credentials_dict,
-                provider_id="test_provider_id",
+                identity=M365IdentityInfo(
+                    identity_id=IDENTITY_ID,
+                    identity_type="User",
+                    tenant_id=TENANT_ID,
+                    tenant_domain=DOMAIN,
+                    tenant_domains=["test.onmicrosoft.com"],
+                    location=LOCATION,
+                ),
             )
-
             assert result.user == credentials_dict["user"]
             assert result.passwd == credentials_dict["encrypted_password"]
 
@@ -595,6 +625,17 @@ class TestM365Provider:
             patch(
                 "prowler.providers.m365.m365_provider.M365Provider.validate_static_credentials"
             ) as mock_validate_static_credentials,
+            patch(
+                "prowler.providers.m365.m365_provider.M365Provider.setup_identity",
+                return_value=M365IdentityInfo(
+                    identity_id=IDENTITY_ID,
+                    identity_type="User",
+                    tenant_id=TENANT_ID,
+                    tenant_domain="contoso.com",
+                    tenant_domains=["contoso.com"],
+                    location=LOCATION,
+                ),
+            ),
         ):
             # Mock setup_session to return a mocked session object
             mock_session = MagicMock()
@@ -620,7 +661,7 @@ class TestM365Provider:
 
             assert exception.type == M365InvalidProviderIdError
             assert (
-                f"Provider ID {provider_id} does not match Application tenant domain {user_domain}"
+                f"The provider ID {provider_id} does not match any of the service principal tenant domains: {user_domain}"
                 in str(exception.value)
             )
 
@@ -646,7 +687,14 @@ class TestM365Provider:
             M365Provider.setup_powershell(
                 env_auth=False,
                 m365_credentials=credentials_dict,
-                provider_id="test_provider_id",
+                identity=M365IdentityInfo(
+                    identity_id=IDENTITY_ID,
+                    identity_type="User",
+                    tenant_id=TENANT_ID,
+                    tenant_domain=DOMAIN,
+                    tenant_domains=["test.onmicrosoft.com"],
+                    location=LOCATION,
+                ),
                 init_modules=False,
             )
             mock_init_modules.assert_not_called()
@@ -673,7 +721,14 @@ class TestM365Provider:
             M365Provider.setup_powershell(
                 env_auth=False,
                 m365_credentials=credentials_dict,
-                provider_id="test_provider_id",
+                identity=M365IdentityInfo(
+                    identity_id=IDENTITY_ID,
+                    identity_type="User",
+                    tenant_id=TENANT_ID,
+                    tenant_domain=DOMAIN,
+                    tenant_domains=["test.onmicrosoft.com"],
+                    location=LOCATION,
+                ),
                 init_modules=True,
             )
             mock_init_modules.assert_called_once()
@@ -702,8 +757,63 @@ class TestM365Provider:
                 M365Provider.setup_powershell(
                     env_auth=False,
                     m365_credentials=credentials_dict,
-                    provider_id="test_provider_id",
+                    identity=M365IdentityInfo(
+                        identity_id=IDENTITY_ID,
+                        identity_type="User",
+                        tenant_id=TENANT_ID,
+                        tenant_domain=DOMAIN,
+                        tenant_domains=["test.onmicrosoft.com"],
+                        location=LOCATION,
+                    ),
                     init_modules=True,
                 )
 
             assert str(exc_info.value) == "Module initialization failed"
+
+    def test_test_connection_provider_id_not_in_tenant_domains(self):
+        """Test that an exception is raised when provider_id is not in tenant_domains"""
+        with (
+            patch(
+                "prowler.providers.m365.m365_provider.M365Provider.setup_session"
+            ) as mock_setup_session,
+            patch(
+                "prowler.providers.m365.m365_provider.M365Provider.validate_static_credentials"
+            ) as mock_validate_static_credentials,
+            patch(
+                "prowler.providers.m365.m365_provider.M365Provider.setup_identity",
+                return_value=M365IdentityInfo(
+                    identity_id=IDENTITY_ID,
+                    identity_type="User",
+                    tenant_id=TENANT_ID,
+                    tenant_domain="contoso.onmicrosoft.com",
+                    tenant_domains=["contoso.onmicrosoft.com", "contoso.com"],
+                    location=LOCATION,
+                ),
+            ),
+        ):
+            # Mock setup_session to return a mocked session object
+            mock_session = MagicMock()
+            mock_setup_session.return_value = mock_session
+
+            # Mock ValidateStaticCredentials to avoid real API calls
+            mock_validate_static_credentials.return_value = None
+
+            provider_id = "test.onmicrosoft.com"
+
+            with pytest.raises(M365InvalidProviderIdError) as exception:
+                M365Provider.test_connection(
+                    tenant_id=str(uuid4()),
+                    region="M365Global",
+                    raise_on_exception=True,
+                    client_id=str(uuid4()),
+                    client_secret=str(uuid4()),
+                    user="user@contoso.onmicrosoft.com",
+                    encrypted_password="test_password",
+                    provider_id=provider_id,
+                )
+
+            assert exception.type == M365InvalidProviderIdError
+            assert (
+                f"The provider ID {provider_id} does not match any of the service principal tenant domains: contoso.onmicrosoft.com, contoso.com"
+                in str(exception.value)
+            )
diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index ed76338775..629b18aaec 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -2,18 +2,30 @@
 
 All notable changes to the **Prowler UI** are documented in this file.
 
-## [v1.7.0] (Prowler v5.7.0) – Not released
+## [v1.8.0] (Prowler v5.8.0) – Not released
+
+### 🐞 Fixes
+
+- Added validation to AWS IAM role. [(#7787)](https://github.com/prowler-cloud/prowler/pull/7787)
+  
+---
+
+## [v1.7.0] (Prowler v5.7.0)
 
 ### 🚀 Added
 
 - Add a new chart to show the split between passed and failed findings. [(#7680)](https://github.com/prowler-cloud/prowler/pull/7680)
 - Added `Accordion` component. [(#7700)](https://github.com/prowler-cloud/prowler/pull/7700)
+- Improve `Provider UID` filter by adding more context and enhancing the UI/UX. [(#7741)](https://github.com/prowler-cloud/prowler/pull/7741)
+- Added an AWS CloudFormation Quick Link to the IAM Role credentials step [(#7735)](https://github.com/prowler-cloud/prowler/pull/7735)
+– Use `getLatestFindings` on findings page when no scan or date filters are applied. [(#7756)](https://github.com/prowler-cloud/prowler/pull/7756)
 
 ### 🐞 Fixes
 
 - Fix form validation in launch scan workflow. [(#7693)](https://github.com/prowler-cloud/prowler/pull/7693)
 - Moved ProviderType to a shared types file and replaced all occurrences across the codebase. [(#7710)](https://github.com/prowler-cloud/prowler/pull/7710)
 - Added filter to retrieve only connected providers on the scan page. [(#7723)](https://github.com/prowler-cloud/prowler/pull/7723)
+- Removed the alias if not added from findings detail page. [(#7751)](https://github.com/prowler-cloud/prowler/pull/7751)
 
 ---
 
diff --git a/ui/actions/findings/findings.ts b/ui/actions/findings/findings.ts
index 3d7f1fec37..0f2359a421 100644
--- a/ui/actions/findings/findings.ts
+++ b/ui/actions/findings/findings.ts
@@ -44,6 +44,47 @@ export const getFindings = async ({
   }
 };
 
+export const getLatestFindings = async ({
+  page = 1,
+  pageSize = 10,
+  query = "",
+  sort = "",
+  filters = {},
+}) => {
+  const headers = await getAuthHeaders({ contentType: false });
+
+  if (isNaN(Number(page)) || page < 1)
+    redirect("findings?include=resources,scan.provider");
+
+  const url = new URL(
+    `${apiBaseUrl}/findings/latest?include=resources,scan.provider`,
+  );
+
+  if (page) url.searchParams.append("page[number]", page.toString());
+  if (pageSize) url.searchParams.append("page[size]", pageSize.toString());
+
+  if (query) url.searchParams.append("filter[search]", query);
+  if (sort) url.searchParams.append("sort", sort);
+
+  Object.entries(filters).forEach(([key, value]) => {
+    url.searchParams.append(key, String(value));
+  });
+
+  try {
+    const findings = await fetch(url.toString(), {
+      headers,
+    });
+    const data = await findings.json();
+    const parsedData = parseStringify(data);
+    revalidatePath("/findings");
+    return parsedData;
+  } catch (error) {
+    // eslint-disable-next-line no-console
+    console.error("Error fetching findings:", error);
+    return undefined;
+  }
+};
+
 export const getMetadataInfo = async ({
   query = "",
   sort = "",
@@ -85,3 +126,45 @@ export const getMetadataInfo = async ({
     return undefined;
   }
 };
+
+export const getLatestMetadataInfo = async ({
+  query = "",
+  sort = "",
+  filters = {},
+}) => {
+  const headers = await getAuthHeaders({ contentType: false });
+
+  const url = new URL(`${apiBaseUrl}/findings/metadata/latest`);
+
+  if (query) url.searchParams.append("filter[search]", query);
+  if (sort) url.searchParams.append("sort", sort);
+
+  Object.entries(filters).forEach(([key, value]) => {
+    // Define filters to exclude
+    const excludedFilters = ["region__in", "service__in", "resource_type__in"];
+    if (
+      key !== "filter[search]" &&
+      !excludedFilters.some((filter) => key.includes(filter))
+    ) {
+      url.searchParams.append(key, String(value));
+    }
+  });
+
+  try {
+    const response = await fetch(url.toString(), {
+      headers,
+    });
+
+    if (!response.ok) {
+      throw new Error(`Failed to fetch metadata info: ${response.statusText}`);
+    }
+
+    const parsedData = parseStringify(await response.json());
+
+    return parsedData;
+  } catch (error) {
+    // eslint-disable-next-line no-console
+    console.error("Error fetching metadata info:", error);
+    return undefined;
+  }
+};
diff --git a/ui/app/(prowler)/findings/page.tsx b/ui/app/(prowler)/findings/page.tsx
index 0ddf609b6e..3615c77b3b 100644
--- a/ui/app/(prowler)/findings/page.tsx
+++ b/ui/app/(prowler)/findings/page.tsx
@@ -1,8 +1,12 @@
 import { Spacer } from "@nextui-org/react";
-import { format, subDays } from "date-fns";
 import React, { Suspense } from "react";
 
-import { getFindings, getMetadataInfo } from "@/actions/findings";
+import {
+  getFindings,
+  getLatestFindings,
+  getLatestMetadataInfo,
+  getMetadataInfo,
+} from "@/actions/findings";
 import { getProviders } from "@/actions/providers";
 import { getScans } from "@/actions/scans";
 import { filterFindings } from "@/components/filters/data-filters";
@@ -13,8 +17,13 @@ import {
 } from "@/components/findings/table";
 import { ContentLayout } from "@/components/ui";
 import { DataTable, DataTableFilterCustom } from "@/components/ui/table";
-import { createDict } from "@/lib";
-import { ProviderProps } from "@/types";
+import {
+  createDict,
+  extractFiltersAndQuery,
+  extractSortAndKey,
+  hasDateOrScanFilter,
+} from "@/lib";
+import { ProviderAccountProps, ProviderProps } from "@/types";
 import { FindingProps, ScanProps, SearchParamsProps } from "@/types/components";
 
 export default async function Findings({
@@ -22,41 +31,14 @@ export default async function Findings({
 }: {
   searchParams: SearchParamsProps;
 }) {
-  const searchParamsKey = JSON.stringify(searchParams || {});
-  const sort = searchParams.sort?.toString();
-
-  // Make sure the sort is correctly encoded
-  const encodedSort = sort?.replace(/^\+/, "");
-
-  const twoDaysAgo = format(subDays(new Date(), 2), "yyyy-MM-dd");
+  const { searchParamsKey, encodedSort } = extractSortAndKey(searchParams);
+  const { filters, query } = extractFiltersAndQuery(searchParams);
 
   // Check if the searchParams contain any date or scan filter
-  const hasDateOrScanFilter = Object.keys(searchParams).some(
-    (key) => key.includes("inserted_at") || key.includes("scan__in"),
-  );
-
-  // Default filters for getMetadataInfo
-  const defaultFilters: Record = hasDateOrScanFilter
-    ? {} // Do not apply default filters if there are date or scan filters
-    : { "filter[inserted_at__gte]": twoDaysAgo };
-
-  // Extract all filter parameters and combine with default filters
-  const filters: Record = {
-    ...defaultFilters,
-    ...Object.fromEntries(
-      Object.entries(searchParams)
-        .filter(([key]) => key.startsWith("filter["))
-        .map(([key, value]) => [
-          key,
-          Array.isArray(value) ? value.join(",") : value?.toString() || "",
-        ]),
-    ),
-  };
-
-  const query = filters["filter[search]"] || "";
+  const hasDateOrScan = hasDateOrScanFilter(searchParams);
 
   const [metadataInfoData, providersData, scansData] = await Promise.all([
-    getMetadataInfo({
+    (hasDateOrScan ? getMetadataInfo : getLatestMetadataInfo)({
       query,
       sort: encodedSort,
       filters,
@@ -73,14 +55,29 @@ export default async function Findings({
   // Get findings data
 
   // Extract provider UIDs
-  const providerUIDs = Array.from(
+  const providerUIDs: string[] = Array.from(
     new Set(
       providersData?.data
-        ?.map((provider: ProviderProps) => provider.attributes.uid)
+        ?.map((provider: ProviderProps) => provider.attributes?.uid)
         .filter(Boolean),
     ),
   );
 
+  const providerDetails: Array<{ [uid: string]: ProviderAccountProps }> =
+    providerUIDs.map((uid) => {
+      const provider = providersData.data.find(
+        (p: { attributes: { uid: string } }) => p.attributes?.uid === uid,
+      );
+
+      return {
+        [uid]: {
+          provider: provider?.attributes?.provider || "",
+          uid: uid,
+          alias: provider?.attributes?.alias ?? null,
+        },
+      };
+    });
+
   // Extract scan UUIDs with "completed" state and more than one resource
   const completedScans = scansData?.data
     ?.filter(
@@ -122,6 +119,7 @@ export default async function Findings({
             key: "provider_uid__in",
             labelCheckboxGroup: "Provider UID",
             values: providerUIDs,
+            valueLabelMapping: providerDetails,
           },
           {
             key: "scan__in",
@@ -147,38 +145,19 @@ const SSRDataTable = async ({
   const page = parseInt(searchParams.page?.toString() || "1", 10);
   const pageSize = parseInt(searchParams.pageSize?.toString() || "10", 10);
   const defaultSort = "severity,status,-inserted_at";
-  const sort = searchParams.sort?.toString() || defaultSort;
 
-  // Make sure the sort is correctly encoded
-  const encodedSort = sort.replace(/^\+/, "");
-
-  const twoDaysAgo = format(subDays(new Date(), 2), "yyyy-MM-dd");
+  const { encodedSort } = extractSortAndKey({
+    ...searchParams,
+    sort: searchParams.sort ?? defaultSort,
+  });
 
+  const { filters, query } = extractFiltersAndQuery(searchParams);
   // Check if the searchParams contain any date or scan filter
-  const hasDateOrScanFilter = Object.keys(searchParams).some(
-    (key) => key.includes("inserted_at") || key.includes("scan__in"),
-  );
+  const hasDateOrScan = hasDateOrScanFilter(searchParams);
 
-  // Default filters for getFindings
-  const defaultFilters: Record = hasDateOrScanFilter
-    ? {} // Do not apply default filters if there are date or scan filters
-    : { "filter[inserted_at__gte]": twoDaysAgo };
+  const fetchFindings = hasDateOrScan ? getFindings : getLatestFindings;
 
-  const filters: Record = {
-    ...defaultFilters,
-    ...Object.fromEntries(
-      Object.entries(searchParams)
-        .filter(([key]) => key.startsWith("filter["))
-        .map(([key, value]) => [
-          key,
-          Array.isArray(value) ? value.join(",") : value?.toString() || "",
-        ]),
-    ),
-  };
-
-  const query = filters["filter[search]"] || "";
-
-  const findingsData = await getFindings({
+  const findingsData = await fetchFindings({
     query,
     page,
     sort: encodedSort,
diff --git a/ui/components/filters/custom-select-provider.tsx b/ui/components/filters/custom-select-provider.tsx
index 818c881f88..89bd537745 100644
--- a/ui/components/filters/custom-select-provider.tsx
+++ b/ui/components/filters/custom-select-provider.tsx
@@ -74,6 +74,7 @@ export const CustomSelectProvider: React.FC = () => {
       placeholder="Select a provider"
       classNames={{
         selectorIcon: "right-2",
+        label: "!z-0",
       }}
       label="Provider"
       labelPlacement="inside"
diff --git a/ui/components/findings/table/finding-detail.tsx b/ui/components/findings/table/finding-detail.tsx
index e58040a374..facd6a1d9f 100644
--- a/ui/components/findings/table/finding-detail.tsx
+++ b/ui/components/findings/table/finding-detail.tsx
@@ -307,7 +307,9 @@ export const FindingDetail = ({
         
 
         

-          {provider.alias}
+          {provider.alias && (
+            {provider.alias}
+          )}
           
              = ({
   return (
     
-      
+      
     
   );
 };
@@ -1010,6 +1014,7 @@ export const M365Icon: React.FC = ({
   size = 24,
   width,
   height,
+  strokeWidth = 2,
   ...props
 }) => {
   return (
@@ -1017,16 +1022,27 @@ export const M365Icon: React.FC = ({
       xmlns="http://www.w3.org/2000/svg"
       width={size || width}
       height={size || height}
-      viewBox="0 0 24 24"
+      viewBox="0 0 48 48"
       fill="none"
       stroke="currentColor"
-      strokeWidth="2"
       strokeLinecap="round"
-      strokeLinejoin="round"
       {...props}
     >
-      
-      
+      
+      
+      
     
   );
 };
@@ -1046,7 +1062,7 @@ export const GCPIcon: React.FC = ({
       fill="currentColor"
       {...props}
     >
-      
+      
     
   );
 };
@@ -1078,3 +1094,26 @@ export const MutedIcon: React.FC = ({
     
   );
 };
+
+export const KubernetesIcon: React.FC = ({
+  size = 24,
+  width,
+  height,
+  ...props
+}) => {
+  return (
+    
+      
+    
+  );
+};
diff --git a/ui/components/providers/workflow/credentials-role-helper.tsx b/ui/components/providers/workflow/credentials-role-helper.tsx
index 896fd657a7..855a3e6fab 100644
--- a/ui/components/providers/workflow/credentials-role-helper.tsx
+++ b/ui/components/providers/workflow/credentials-role-helper.tsx
@@ -1,9 +1,11 @@
 "use client";
 
 import { Snippet } from "@nextui-org/react";
-import Link from "next/link";
 import { useSession } from "next-auth/react";
 
+import { CustomButton } from "@/components/ui/custom";
+import { getAWSCredentialsTemplateLinks } from "@/lib";
+
 export const CredentialsRoleHelper = () => {
   const { data: session } = useSession();
 
@@ -12,24 +14,50 @@ export const CredentialsRoleHelper = () => {
       

         

           A new read-only IAM role must be manually created.
+        

+
+        
+          Use the following AWS CloudFormation Quick Link to deploy the IAM Role
+        
+
+        

+          

+          
+            or
+          
+          

+        

+        

           Use one of the following templates to create the IAM role:
         

+
         

-          
             CloudFormation Template
-          
-          
+          
             Terraform Code
-          
+          
         

+
         

           The External ID will also be required:
         

diff --git a/ui/components/providers/workflow/forms/via-role/aws-role-form.tsx b/ui/components/providers/workflow/forms/via-role/aws-role-form.tsx
index 7ed4cd9438..c9994284d9 100644
--- a/ui/components/providers/workflow/forms/via-role/aws-role-form.tsx
+++ b/ui/components/providers/workflow/forms/via-role/aws-role-form.tsx
@@ -1,4 +1,4 @@
-import { Select, SelectItem, Spacer } from "@nextui-org/react";
+import { Divider, Select, SelectItem, Spacer } from "@nextui-org/react";
 import { Control, UseFormSetValue, useWatch } from "react-hook-form";
 
 import { CustomInput } from "@/components/ui/custom";
@@ -89,10 +89,11 @@ export const AWSCredentialsRoleForm = ({
           />
         
       )}
+      
+      Assume Role
       
 
       
-      Assume Role
 
        {
-  const getProviderHelpText = (provider: string) => {
-    switch (provider) {
-      case "aws":
-        return {
-          text: "Need help connecting your AWS account?",
-          link: "https://goto.prowler.com/provider-aws",
-        };
-      case "azure":
-        return {
-          text: "Need help connecting your Azure subscription?",
-          link: "https://goto.prowler.com/provider-azure",
-        };
-      case "m365":
-        return {
-          text: "Need help connecting your Microsoft 365 account?",
-          link: "https://goto.prowler.com/provider-m365",
-        };
-      case "gcp":
-        return {
-          text: "Need help connecting your GCP project?",
-          link: "https://goto.prowler.com/provider-gcp",
-        };
-      case "kubernetes":
-        return {
-          text: "Need help connecting your Kubernetes cluster?",
-          link: "https://goto.prowler.com/provider-k8s",
-        };
-      default:
-        return {
-          text: "How to setup a provider?",
-          link: "https://goto.prowler.com/provider-help",
-        };
-    }
-  };
-
   return (
     

       

diff --git a/ui/components/ui/custom/custom-dropdown-filter.tsx b/ui/components/ui/custom/custom-dropdown-filter.tsx
index 7f659d9c13..ee18bab9bc 100644
--- a/ui/components/ui/custom/custom-dropdown-filter.tsx
+++ b/ui/components/ui/custom/custom-dropdown-filter.tsx
@@ -18,6 +18,8 @@ import { PlusCircleIcon } from "@/components/icons";
 import { useUrlFilters } from "@/hooks/use-url-filters";
 import { CustomDropdownFilterProps } from "@/types";
 
+import { EntityInfoShort } from "../entities";
+
 const filterSelectedClass =
   "inline-flex items-center border py-1 text-xs transition-colors border-transparent bg-default-500 text-secondary-foreground hover:bg-default-500/80 rounded-md px-2 font-normal";
 
@@ -192,18 +194,35 @@ export const CustomDropdownFilter: React.FC = ({
                 hideScrollBar
                 className="flex max-h-96 max-w-56 flex-col gap-y-2 py-2"
               >
-                {memoizedFilterValues.map((value) => (
-                  
-                    {value}
-                  
-                ))}
+                {memoizedFilterValues.map((value) => {
+                  // Find the corresponding entity from valueLabelMapping
+                  const matchingEntry = filter.valueLabelMapping?.find(
+                    (entry) => entry[value],
+                  );
+                  const entity = matchingEntry?.[value];
+
+                  return (
+                    
+                      {entity ? (
+                        
+                      ) : (
+                        value
+                      )}
+                    
+                  );
+                })}
               
             
           

diff --git a/ui/lib/external-urls.ts b/ui/lib/external-urls.ts
new file mode 100644
index 0000000000..cea7a694ae
--- /dev/null
+++ b/ui/lib/external-urls.ts
@@ -0,0 +1,45 @@
+export const getProviderHelpText = (provider: string) => {
+  switch (provider) {
+    case "aws":
+      return {
+        text: "Need help connecting your AWS account?",
+        link: "https://goto.prowler.com/provider-aws",
+      };
+    case "azure":
+      return {
+        text: "Need help connecting your Azure subscription?",
+        link: "https://goto.prowler.com/provider-azure",
+      };
+    case "m365":
+      return {
+        text: "Need help connecting your Microsoft 365 account?",
+        link: "https://goto.prowler.com/provider-m365",
+      };
+    case "gcp":
+      return {
+        text: "Need help connecting your GCP project?",
+        link: "https://goto.prowler.com/provider-gcp",
+      };
+    case "kubernetes":
+      return {
+        text: "Need help connecting your Kubernetes cluster?",
+        link: "https://goto.prowler.com/provider-k8s",
+      };
+    default:
+      return {
+        text: "How to setup a provider?",
+        link: "https://goto.prowler.com/provider-help",
+      };
+  }
+};
+
+export const getAWSCredentialsTemplateLinks = () => {
+  return {
+    cloudformation:
+      "https://github.com/prowler-cloud/prowler/blob/master/permissions/templates/cloudformation/prowler-scan-role.yml",
+    cloudformationQuickLink:
+      "https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/quickcreate?templateURL=https%3A%2F%2Fprowler-cloud-public.s3.eu-west-1.amazonaws.com%2Fpermissions%2Ftemplates%2Faws%2Fcloudformation%2Fprowler-scan-role.yml&stackName=ProwlerScanRole¶m_ExternalId=",
+    terraform:
+      "https://github.com/prowler-cloud/prowler/blob/master/permissions/templates/terraform/main.tf",
+  };
+};
diff --git a/ui/lib/helper-filters.ts b/ui/lib/helper-filters.ts
new file mode 100644
index 0000000000..fe17185746
--- /dev/null
+++ b/ui/lib/helper-filters.ts
@@ -0,0 +1,46 @@
+/**
+ * Extracts normalized filters and search query from the URL search params.
+ * Used Server Side Rendering (SSR). There is a hook (useUrlFilters) for client side.
+ */
+export const extractFiltersAndQuery = (
+  searchParams: Record,
+) => {
+  const filters: Record = {
+    ...Object.fromEntries(
+      Object.entries(searchParams)
+        .filter(([key]) => key.startsWith("filter["))
+        .map(([key, value]) => [
+          key,
+          Array.isArray(value) ? value.join(",") : value?.toString() || "",
+        ]),
+    ),
+  };
+
+  const query = filters["filter[search]"] || "";
+  return { filters, query };
+};
+
+/**
+ * Returns true if there are any scan or inserted_at filters in the search params.
+ * Used to determine whether to call the full findings endpoint.
+ */
+export const hasDateOrScanFilter = (searchParams: Record) =>
+  Object.keys(searchParams).some(
+    (key) => key.includes("inserted_at") || key.includes("scan__in"),
+  );
+
+/**
+ * Encodes sort strings by removing leading "+" symbols.
+ */
+export const encodeSort = (sort?: string) => sort?.replace(/^\+/, "") || "";
+
+/**
+ * Extracts the sort string and the stable key to use in Suspense boundaries.
+ */
+export const extractSortAndKey = (searchParams: Record) => {
+  const searchParamsKey = JSON.stringify(searchParams || {});
+  const rawSort = searchParams.sort?.toString();
+  const encodedSort = encodeSort(rawSort);
+
+  return { searchParamsKey, rawSort, encodedSort };
+};
diff --git a/ui/lib/index.ts b/ui/lib/index.ts
index 6560f7b5a9..6e17065079 100644
--- a/ui/lib/index.ts
+++ b/ui/lib/index.ts
@@ -1,3 +1,5 @@
+export * from "./external-urls";
 export * from "./helper";
+export * from "./helper-filters";
 export * from "./menu-list";
 export * from "./utils";
diff --git a/ui/lib/menu-list.ts b/ui/lib/menu-list.ts
index ce7de725ab..a6c02d6a3a 100644
--- a/ui/lib/menu-list.ts
+++ b/ui/lib/menu-list.ts
@@ -3,7 +3,6 @@
 import {
   AlertCircle,
   Bookmark,
-  Boxes,
   CloudCog,
   Group,
   LayoutGrid,
@@ -26,6 +25,7 @@ import {
   CircleHelpIcon,
   DocIcon,
   GCPIcon,
+  KubernetesIcon,
   M365Icon,
   SupportIcon,
 } from "@/components/icons/Icons";
@@ -108,7 +108,7 @@ export const getMenuList = (pathname: string): GroupProps[] => {
             {
               href: "/findings?filter[status__in]=FAIL&filter[severity__in]=critical%2Chigh%2Cmedium&filter[provider_type__in]=kubernetes&sort=severity,-inserted_at",
               label: "Kubernetes",
-              icon: Boxes,
+              icon: KubernetesIcon,
             },
           ],
           defaultOpen: false,
diff --git a/ui/types/filters.ts b/ui/types/filters.ts
index 944706f7aa..a8fb78dde9 100644
--- a/ui/types/filters.ts
+++ b/ui/types/filters.ts
@@ -1,7 +1,10 @@
+import { ProviderAccountProps } from "./providers";
+
 export interface FilterOption {
   key: string;
   labelCheckboxGroup: string;
   values: string[];
+  valueLabelMapping?: Array<{ [uid: string]: ProviderAccountProps }>;
 }
 
 export interface CustomDropdownFilterProps {
diff --git a/ui/types/formSchemas.ts b/ui/types/formSchemas.ts
index 3fc096d03d..b0c64dfa24 100644
--- a/ui/types/formSchemas.ts
+++ b/ui/types/formSchemas.ts
@@ -155,7 +155,7 @@ export const addCredentialsRoleFormSchema = (providerType: string) =>
         .object({
           providerId: z.string(),
           providerType: z.string(),
-          role_arn: z.string().optional(),
+          role_arn: z.string().nonempty("AWS Role ARN is required"),
           external_id: z.string().optional(),
           aws_access_key_id: z.string().optional(),
           aws_secret_access_key: z.string().optional(),
diff --git a/ui/types/providers.ts b/ui/types/providers.ts
index 50353125e7..6bac15262c 100644
--- a/ui/types/providers.ts
+++ b/ui/types/providers.ts
@@ -45,6 +45,12 @@ export interface ProviderProps {
   groupNames?: string[];
 }
 
+export interface ProviderAccountProps {
+  provider: ProviderType;
+  uid: string;
+  alias: string;
+}
+
 export interface ProviderOverviewProps {
   data: {
     type: "provider-overviews";
diff --git a/util/generate_compliance_json_from_csv_for_cis10_github.py b/util/generate_compliance_json_from_csv_for_cis10_github.py
new file mode 100644
index 0000000000..3297c70640
--- /dev/null
+++ b/util/generate_compliance_json_from_csv_for_cis10_github.py
@@ -0,0 +1,40 @@
+import csv
+import json
+import sys
+
+# Convert a CSV file following the CIS 1.0 GitHub benchmark into a Prowler v3.0 Compliance JSON file
+# CSV fields:
+# Id, Title,Checks,Attributes_Section,Attributes_Level,Attributes_AssessmentStatus,Attributes_Description,Attributes_RationalStatement,Attributes_ImpactStatement,Attributes_RemediationProcedure,Attributes_AuditProcedure,Attributes_AdditionalInformation,Attributes_References
+
+# get the CSV filename to convert from
+file_name = sys.argv[1]
+
+# read the CSV file rows and use the column fields to form the Prowler compliance JSON file 'cis_1.0_github.json'
+output = {"Framework": "CIS-GitHub", "Version": "1.5", "Requirements": []}
+with open(file_name, newline="", encoding="utf-8") as f:
+    reader = csv.reader(f, delimiter=",")
+    for row in reader:
+        attribute = {
+            "Section": row[3],
+            "Profile": row[4],
+            "AssessmentStatus": row[5],
+            "Description": row[6],
+            "RationaleStatement": row[7],
+            "ImpactStatement": row[8],
+            "RemediationProcedure": row[9],
+            "AuditProcedure": row[10],
+            "AdditionalInformation": row[11],
+            "References": row[12],
+        }
+        output["Requirements"].append(
+            {
+                "Id": row[0],
+                "Description": row[1],
+                "Checks": list(map(str.strip, row[2].split(","))),
+                "Attributes": [attribute],
+            }
+        )
+
+# Write the output Prowler compliance JSON file 'cis_1.0_github.json' locally
+with open("cis_1.0_github.json", "w", encoding="utf-8") as outfile:
+    json.dump(output, outfile, indent=4, ensure_ascii=False)