All controls

Each control declares the evidence it gathers, resolved runtime state where a service exposes it (sshd -T, sysctl, systemctl, auditctl), otherwise persistent config, inventory or filesystem state. Filter by domain, severity, standard or OS, each row links to its check, evidence type, remediation and mappings.