Kernel & network (sysctl): 70 controls for Linux hardening

The domain in figures

What does Pavois check in this domain?

effective runtime 70

Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.

Which standards does this domain cover?

One effective-configuration check serves as evidence for several standards at once. The references below are the ones the corpus actually carries, never a claimed equivalence. how to read a standard mapping.

CIS

1.4.2, 1.4.3, 1.4.5, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.5.6, 1.5.7, 1.5.8, 3.3.1, 3.3.1.1, 3.3.1.2, 3.3.1.3, 3.3.1.4, 3.3.1.5, 3.3.1.6, 3.3.1.7, 3.3.1.8, 3.3.1.9, 3.3.1.10, 3.3.1.11, 3.3.1.12, 3.3.1.13, 3.3.1.14, 3.3.1.15, 3.3.1.16, 3.3.1.17, 3.3.1.18, 3.3.2, 3.3.2.1, 3.3.2.2, 3.3.2.3, 3.3.2.4, 3.3.2.5, 3.3.2.6, 3.3.2.7, 3.3.2.8, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.7, 3.3.8, 3.3.9, 3.3.10, 3.3.11

ANSSI BP-028

R8, R9, R11, R12, R13, R14

NIST 800-53

3.1.5, 3.1.7, 3.1.20, AC-6, AC-6(1), CM-6, CM-6(a), CM-6(b), CM-7(a), CM-7(b), SC-5, SC-5(1), SC-5(2), SC-5(3)(a), SC-7(10), SC-7(a), SC-30, SC-30(2), SC-30(5), SI-11(a), SI-11(b)

PCI DSS

1.4.2, 1.4.3, 1.4.5, 3.3.1.1

DISA STIG

UBTU-22-213010, UBTU-22-213020, UBTU-22-253010, UBTU-24-600140, UBTU-24-600190, UBTU-24-700310

The 70 controls of the Kernel & network (sysctl) domain

Sources & references

Full control catalogue · All control domains