--- title: Policy Rules: CIS Benchmark Checks | Wartiva description: Every Wartiva policy rule: CIS Benchmark checks for macOS, Windows 11, and Ubuntu 24.04 LTS, plus Wartiva's own controls, with rationale and remediation. url: https://wartiva.com/policy-rules.html updated: 2026-10-07 --- Reference # Wartiva Policy Rules All 720 checks Wartiva runs: the CIS Benchmarks for macOS Tahoe, Windows 11, and Ubuntu 24.04 LTS, plus Wartiva's own controls. Each lists what it finds, why it matters, and how to fix it. Wartiva mirrors compressed endpoint state to the cloud, so every rule runs there instead of on your users' machines. When a rule fails, Wartiva records a finding and saves a copy of the object exactly as it appeared at the moment of discovery: [defensible evidence](https://wartiva.com/platform/evidence-and-attack-paths.html) for audits. Each finding's remediation instructions can become a ready-to-run bash or PowerShell [script, safety-reviewed by AI](https://wartiva.com/platform/ai-remediation.html), that you approve or automate. Configuration rules are evaluated every time the object changes; search rules run on a schedule. Make the catalog yours: disable any rule, change its severity, and add your own. Edit or write the [Rego (OPA)](https://wartiva.com/platform/policy-as-code.html) behind configuration rules, add search and path rules, and test them against mock data in the Wartiva UI before they go live. Wartiva's AI policy assistant can tailor rules or draft new ones for your environment. You can also [list the rules through the API](https://wartiva.com/api-docs/queries/policy-rules-list.html). Every check lists its finding (what Wartiva flags), why it matters and its impact, how to fix it in the settings and from the command line, its severity, and its mappings to the benchmark section, risk, and MITRE ATT&CK tactic. Checks are also mapped to the CIS Controls v8, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2, CMMC 2.0, and PCI DSS v4.0.1 requirements they provide evidence for. ## [CIS Apple macOS 26 Tahoe Benchmark](https://wartiva.com/policy-rules/apple-macos-26-tahoe.html) 90 checks CIS Benchmark checks for Apple macOS 26 Tahoe: software updates, System Settings, logging and auditing, network configuration, system access, and applications. - [1 Install Updates](https://wartiva.com/policy-rules/apple-macos-26-tahoe/install-updates.html) 6 checks - [2 System Settings](https://wartiva.com/policy-rules/apple-macos-26-tahoe/system-settings.html) 47 checks - [3 Logging and Auditing](https://wartiva.com/policy-rules/apple-macos-26-tahoe/logging-and-auditing.html) 4 checks - [4 Network Configurations](https://wartiva.com/policy-rules/apple-macos-26-tahoe/network-configurations.html) 3 checks - [5 System Access](https://wartiva.com/policy-rules/apple-macos-26-tahoe/system-access.html) 22 checks - [6 Applications](https://wartiva.com/policy-rules/apple-macos-26-tahoe/applications.html) 8 checks ## [CIS Microsoft Windows 11 Stand-alone Benchmark](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone.html) 484 checks CIS Benchmark checks for stand-alone Microsoft Windows 11: account and local policies, system services, Windows Firewall, audit policy, and administrative templates. - [1 Account Policies](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/account-policies.html) 11 checks - [2.2 User Rights Assignment](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/user-rights-assignment.html) 38 checks - [2.3 Security Options](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/security-options.html) 53 checks - [5 System Services](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/system-services.html) 44 checks - [9 Windows Defender Firewall with Advanced Security](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/windows-defender-firewall-with-advanced-security.html) 14 checks - [17 Advanced Audit Policy Configuration](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/advanced-audit-policy-configuration.html) 27 checks - [18.1 Control Panel](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/control-panel.html) 4 checks - [18.4 MS Security Guide](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/ms-security-guide.html) 6 checks - [18.5 MSS (Legacy)](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/mss-legacy.html) 12 checks - [18.6 Network](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/network.html) 27 checks - [18.7 Printers](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/printers.html) 18 checks - [18.8 Start Menu and Taskbar](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/start-menu-and-taskbar.html) 2 checks - [18.9 System](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/system.html) 57 checks - [18.10 Windows Components](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/windows-components.html) 158 checks - [18.11 Custom Settings](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/custom-settings.html) 2 checks - [19 Administrative Templates (User)](https://wartiva.com/policy-rules/microsoft-windows-11-stand-alone/administrative-templates-user.html) 11 checks ## [CIS Ubuntu Linux 24.04 LTS Benchmark](https://wartiva.com/policy-rules/ubuntu-linux-24-04-lts.html) 85 checks CIS Benchmark checks for Ubuntu Linux 24.04 LTS: filesystems, services, networking, the host firewall, access control, and logging and auditing. - [1 Initial Setup](https://wartiva.com/policy-rules/ubuntu-linux-24-04-lts/initial-setup.html) 30 checks - [2 Services](https://wartiva.com/policy-rules/ubuntu-linux-24-04-lts/services.html) 31 checks - [3 Network](https://wartiva.com/policy-rules/ubuntu-linux-24-04-lts/network.html) 1 check - [4 Host Based Firewall](https://wartiva.com/policy-rules/ubuntu-linux-24-04-lts/host-based-firewall.html) 2 checks - [5 Access Control](https://wartiva.com/policy-rules/ubuntu-linux-24-04-lts/access-control.html) 9 checks - [6 Logging and Auditing](https://wartiva.com/policy-rules/ubuntu-linux-24-04-lts/logging-and-auditing.html) 10 checks - [7 System Maintenance](https://wartiva.com/policy-rules/ubuntu-linux-24-04-lts/system-maintenance.html) 2 checks ## [Wartiva Security Controls](https://wartiva.com/policy-rules/wartiva.html) 61 checks Controls Wartiva wrote for risks the CIS Benchmarks don't cover, found across your security graph: wireless networks, ARP, SSL/TLS, network services, endpoint posture, Active Directory, and exposed devices. - [Active Directory](https://wartiva.com/policy-rules/wartiva/active-directory.html) 3 checks - [ARP](https://wartiva.com/policy-rules/wartiva/arp.html) 2 checks - [Device Exposure](https://wartiva.com/policy-rules/wartiva/device-exposure.html) 7 checks - [Endpoint Posture](https://wartiva.com/policy-rules/wartiva/endpoint-posture.html) 23 checks - [Network Services](https://wartiva.com/policy-rules/wartiva/network-services.html) 13 checks - [SSL/TLS](https://wartiva.com/policy-rules/wartiva/ssl-tls.html) 8 checks - [Wireless Networks](https://wartiva.com/policy-rules/wartiva/wireless-networks.html) 5 checks ## See how your fleet scores against every rule Wartiva is in early access. Request your spot and run all 720 checks across your endpoints, with evidence your auditors can use. [Request Early Access](https://wartiva.com/early-access.html) --- Wartiva is in early access. Request access: https://wartiva.com/early-access.html All pages: https://wartiva.com/llms.txt