Compliance Coverage

Sicura ships compliance data for industry-standard benchmarks. This section is the reference for exactly what is covered: each matrix below details every benchmark rule and whether Sicura enforces it.

Use the profile names on this page in the Sicura Compliance Engine configuration to report on and enforce these benchmarks. For how to apply a benchmark to your systems, see the usage guide for the benchmark.

Coverage at a glance

Benchmark	Coverage matrix	Usage guide
Linux — CIS Benchmarks	Coverage matrix	Usage guide
Linux — DISA STIG	Coverage matrix	Usage guide
Windows — CIS Benchmarks	Coverage matrix	Usage guide
Windows — DISA STIG	Coverage matrix	—

Each matrix page opens with the benchmark versions and operating-system versions it covers.

Linux

CIS profiles

Covered operating systems: AlmaLinux 8 and 9, Oracle Linux 8 and 9, Red Hat Enterprise Linux 8 and 9, and Rocky Linux 8 and 9.

• cis:level:1:server
• cis:level:2:server
• cis:implementation:group:1:server
• cis:implementation:group:2:server
• cis:implementation:group:3:server

DISA STIG profiles

Covered operating systems: Oracle Linux 8 and Red Hat Enterprise Linux 8 and 9.

• disa:mac-1:classified
• disa:mac-1:public
• disa:mac-1:sensitive
• disa:mac-2:classified
• disa:mac-2:public
• disa:mac-2:sensitive
• disa:mac-3:classified
• disa:mac-3:public
• disa:mac-3:sensitive

Windows

CIS profiles

Covered operating systems: Windows Server 2016, 2019, and 2022, and Windows 11.

• cis:level:1:domain:controller
• cis:level:2:domain:controller
• cis:level:1:member:server
• cis:level:2:member:server

Note

The following profiles are only defined by CIS on Windows Server 2016 and 2019. They provide enforcement for boot and virtualization options that are not available in previous versions of Windows. If needed, specify these profiles in addition to a Level 1 or Level 2 profile.

• cis:next:generation:windows:security:domain:controller
• cis:next:generation:windows:security:member:server

Note

The following profiles are only defined by CIS on Windows 11; the domain controller and member server profiles are not available for this operating system.

• cis:level:1:l1:corporateenterprise:environment:general:use
• cis:level:1:l1::bitlocker:bl
• cis:level:2:l2:high:securitysensitive:data:environment:limited:functionality
• cis:level:2:l2::bitlocker:bl

DISA STIG profiles

Covered operating systems: Windows Server 2016, 2019, and 2022, and Windows 11.

• disa:mac-1:classified
• disa:mac-1:public
• disa:mac-1:sensitive
• disa:mac-2:classified
• disa:mac-2:public
• disa:mac-2:sensitive
• disa:mac-3:classified
• disa:mac-3:public
• disa:mac-3:sensitive