ComplianceAsCode · Mab879 · Sep 16, 2025 · Sep 5, 2025 · Sep 8, 2025 · Sep 9, 2025
diff --git a/..._os/guide/auditing/configure_auditd_data_retention/var_auditd_admin_space_left_action.var b/..._os/guide/auditing/configure_auditd_data_retention/var_auditd_admin_space_left_action.var
@@ -20,3 +20,4 @@ options:
     ignore: ignore
     cis_rhel8: single|halt
     cis_rhel9: single|halt
+    cis_rhel10: single|halt
diff --git a/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_error_action.var b/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_error_action.var
@@ -23,6 +23,7 @@ options:
     rhel8: syslog|single|halt
     cis_rhel8: syslog|single|halt
     cis_rhel9: syslog|single|halt
+    cis_rhel10: syslog|single|halt
     cis_ubuntu2404: syslog|single|halt
     cis_debian12: syslog|single|halt
 
diff --git a/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_full_action.var b/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_full_action.var
@@ -24,5 +24,6 @@ options:
     rhel8: syslog|single|halt
     cis_rhel8: syslog|single|halt
     cis_rhel9: halt|single
+    cis_rhel10: halt|single
     cis_ubuntu2404: halt|single
     cis_debian12: halt|single
diff --git a/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_space_left_action.var b/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_space_left_action.var
@@ -20,3 +20,4 @@ options:
     ignore: ignore
     cis_rhel8: email|exec|single|halt
     cis_rhel9: email|exec|single|halt
+    cis_rhel10: email|exec|single|halt
diff --git a/linux_os/guide/services/base/service_cockpit_disabled/rule.yml b/linux_os/guide/services/base/service_cockpit_disabled/rule.yml
@@ -13,6 +13,9 @@ rationale: |-
 
 severity: medium
 
+identifiers:
+    cce@rhel10: CCE-87509-6
+
 platform: system_with_kernel
 
 ocil_clause: |-

diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_forwarding/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_forwarding/rule.yml
@@ -11,6 +11,9 @@ rationale: |-
 
 severity: medium
 
+identifiers:
+    cce@rhel10: CCE-87508-8
+
 ocil_clause: "The DisableForwarding option exists and is yes"
 
 ocil: |-

diff --git a/linux_os/guide/services/ssh/sshd_strong_kex.var b/linux_os/guide/services/ssh/sshd_strong_kex.var
@@ -15,6 +15,7 @@ options:
     pcidss: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
     cis_rhel8: -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1
     cis_rhel9: -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1
+    cis_rhel10: -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1
     cis_sle12: curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
     cis_sle15: curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
     cis_ubuntu2204: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256

diff --git a/linux_os/guide/services/ssh/sshd_strong_macs.var b/linux_os/guide/services/ssh/sshd_strong_macs.var
@@ -14,6 +14,7 @@ options:
     default: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160
     cis_rhel8: -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,umac-64@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,umac-64-etm@openssh.com
     cis_rhel9: -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,umac-64@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,umac-64-etm@openssh.com
+    cis_rhel10: -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,umac-64@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,umac-64-etm@openssh.com
     cis_sle12: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160
     cis_sle15: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
     cis_tencentos4: hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-256-etm@openssh.com

diff --git a/linux_os/guide/system/accounts/accounts-restrictions/no_nologin_in_shells/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/no_nologin_in_shells/rule.yml
@@ -17,6 +17,7 @@ rationale: |-
 severity: medium
 
 identifiers:
+    cce@rhel10: CCE-87072-5
     cce@sle15: CCE-92592-5
 
 ocil_clause: 'nologin is listed in /etc/shells'

diff --git a/...system/accounts/accounts-restrictions/root_logins/groups_no_zero_gid_except_root/rule.yml b/...system/accounts/accounts-restrictions/root_logins/groups_no_zero_gid_except_root/rule.yml
@@ -15,6 +15,7 @@ rationale: |-
 severity: high
 
 identifiers:
+    cce@rhel10: CCE-87073-3
     cce@sle15: CCE-92565-1
 
 ocil_clause: 'any groups other than "root" have a GID of "0"'

diff --git a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_root/rule.yml b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_root/rule.yml
@@ -16,6 +16,7 @@ rationale: |-
 severity: medium
 
 identifiers:
+    cce@rhel10: CCE-87074-1
     cce@sle15: CCE-92484-5
 
 platform: package[bash]
diff --git a/...em/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_forwarding/rule.yml b/...em/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_forwarding/rule.yml
@@ -13,10 +13,11 @@ rationale: |-
 severity: medium
 
 identifiers:
+    cce@rhel10: CCE-87075-8
     cce@sle12: CCE-83248-5
     cce@sle15: CCE-85725-0
     cce@slmicro5: CCE-93641-9
-    cce@slmicro6: CCE-95085-7 
+    cce@slmicro6: CCE-95085-7
 
 references:
     nist: CM-6(b),CM-6.1(iv)

diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_overlayfs_disabled/rule.yml b/linux_os/guide/system/permissions/mounting/kernel_module_overlayfs_disabled/rule.yml
@@ -17,6 +17,7 @@ rationale: |-
 severity: low
 
 identifiers:
+    cce@rhel10: CCE-87507-0
     cce@sle15: CCE-92579-2
 
 platform: system_with_kernel

@@ -2,17 +2,22 @@
 documentation_complete: true
 
 metadata:
+    version: 1.0.0
     SMEs:
-        - marcusburghardt
+        - mab879
+        - ggbecker
 
 reference: https://www.cisecurity.org/benchmark/red_hat_linux/
 
-title: 'DRAFT - CIS Red Hat Enterprise Linux 10 Benchmark for Level 2 - Server'
+title: 'CIS Red Hat Enterprise Linux 10 Benchmark for Level 2 - Server'
 
 description: |-
-    This is a draft profile for experimental purposes.
-    It is based on the CIS RHEL 9 profile, because an equivalent policy for RHEL 10 didn't yet
-    exist at time of the release.
+    This profile defines a baseline that aligns to the "Level 2 - Server"
+    configuration from the Center for Internet Security® Red Hat Enterprise
+    Linux 10 Benchmark™, v1.0.0, released 2025-08-27.
+
+    This profile includes Center for Internet Security®
+    Red Hat Enterprise Linux 10 CIS Benchmarks™ content.
 
 selections:
     - cis_rhel10:all:l2_server

@@ -2,17 +2,22 @@
 documentation_complete: true
 
 metadata:
+    version: 1.0.0
     SMEs:
-        - marcusburghardt
+        - mab879
+        - ggbecker
 
 reference: https://www.cisecurity.org/benchmark/red_hat_linux/
 
-title: 'DRAFT - CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Server'
+title: 'CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Server'
 
 description: |-
-    This is a draft profile for experimental purposes.
-    It is based on the CIS RHEL 9 profile, because an equivalent policy for RHEL 10 didn't yet
-    exist at time of the release.
+    This profile defines a baseline that aligns to the "Level 1 - Server"
+    configuration from the Center for Internet Security® Red Hat Enterprise
+    Linux 10 Benchmark™, v1.0.0, released 2025-08-27.
+
+    This profile includes Center for Internet Security®
+    Red Hat Enterprise Linux 10 CIS Benchmarks™ content.
 
 selections:
     - cis_rhel10:all:l1_server

@@ -2,17 +2,22 @@
 documentation_complete: true
 
 metadata:
+    version: 1.0.0
     SMEs:
-        - marcusburghardt
+        - mab879
+        - ggbecker
 
 reference: https://www.cisecurity.org/benchmark/red_hat_linux/
 
-title: 'DRAFT - CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Workstation'
+title: 'CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Workstation'
 
 description: |-
-    This is a draft profile for experimental purposes.
-    It is based on the CIS RHEL 9 profile, because an equivalent policy for RHEL 10 didn't yet
-    exist at time of the release.
+    This profile defines a baseline that aligns to the "Level 1 - Workstation"
+    configuration from the Center for Internet Security® Red Hat Enterprise
+    Linux 10 Benchmark™, v1.0.0, released 2025-08-27.
+
+    This profile includes Center for Internet Security®
+    Red Hat Enterprise Linux 10 CIS Benchmarks™ content.
 
 selections:
     - cis_rhel10:all:l1_workstation

@@ -2,17 +2,22 @@
 documentation_complete: true
 
 metadata:
+    version: 1.0.0
     SMEs:
-        - marcusburghardt
+        - mab879
+        - ggbecker
 
 reference: https://www.cisecurity.org/benchmark/red_hat_linux/
 
-title: 'DRAFT - CIS Red Hat Enterprise Linux 10 Benchmark for Level 2 - Workstation'
+title: 'CIS Red Hat Enterprise Linux 10 Benchmark for Level 2 - Workstation'
 
 description: |-
-    This is a draft profile for experimental purposes.
-    It is based on the CIS RHEL 9 profile, because an equivalent policy for RHEL 10 didn't yet
-    exist at time of the release.
+    This profile defines a baseline that aligns to the "Level 2 - Workstation"
+    configuration from the Center for Internet Security® Red Hat Enterprise
+    Linux 10 Benchmark™, v1.0.0, released 2025-08-27.
+
+    This profile includes Center for Internet Security®
+    Red Hat Enterprise Linux 10 CIS Benchmarks™ content.
 
 selections:
     - cis_rhel10:all:l2_workstation

@@ -34,3 +34,10 @@ selections:
     - package_scap-security-guide_installed
     - set_password_hashing_yescrypt_cost_factor_logindefs
     - var_authselect_profile=local
+    - audit_rules_networkconfig_modification_network_scripts
+    - package_pam_pwquality_installed
+    - journald_compress
+    - socket_systemd-journal-remote_disabled
+    - package_systemd-journal-remote_installed
+    - journald_storage
+    - partition_for_dev_shm
@@ -229,10 +229,6 @@ CCE-87062-6
 CCE-87063-4
 CCE-87064-2
 CCE-87068-3
-CCE-87072-5
-CCE-87073-3
-CCE-87074-1
-CCE-87075-8
 CCE-87076-6
 CCE-87078-2
 CCE-87079-0
@@ -487,9 +483,6 @@ CCE-87500-5
 CCE-87501-3
 CCE-87503-9
 CCE-87505-4
-CCE-87507-0
-CCE-87508-8
-CCE-87509-6
 CCE-87510-4
 CCE-87511-2
 CCE-87512-0

@@ -30,6 +30,7 @@ accounts_tmout
 accounts_umask_etc_bashrc
 accounts_umask_etc_login_defs
 accounts_umask_etc_profile
+accounts_umask_root
 accounts_user_dot_group_ownership
 accounts_user_dot_no_world_writable_programs
 accounts_user_dot_user_ownership
@@ -60,6 +61,7 @@ audit_rules_file_deletion_events_renameat2
 audit_rules_file_deletion_events_unlink
 audit_rules_file_deletion_events_unlinkat
 audit_rules_immutable
+audit_rules_kernel_module_loading_create
 audit_rules_kernel_module_loading_delete
 audit_rules_kernel_module_loading_finit
 audit_rules_kernel_module_loading_init
@@ -108,7 +110,6 @@ chronyd_run_as_chrony_user
 chronyd_specify_remote_server
 cis_banner_text=cis
 configure_crypto_policy
-configure_ssh_crypto_policy
 coredump_disable_backtraces
 coredump_disable_storage
 dconf_db_up_to_date
@@ -125,6 +126,7 @@ dconf_gnome_session_idle_user_locks
 dir_perms_world_writable_sticky_bits
 directory_permissions_var_log_audit
 disable_host_auth
+disable_users_coredumps
 ensure_gpgcheck_globally_activated
 ensure_pam_wheel_group_empty
 ensure_root_password_configured
@@ -226,6 +228,7 @@ firewalld_loopback_traffic_trusted
 gid_passwd_group_same
 group_unique_id
 group_unique_name
+groups_no_zero_gid_except_root
 grub2_audit_argument
 grub2_audit_backlog_limit_argument
 grub2_enable_selinux
@@ -234,6 +237,17 @@ has_nonlocal_mta
 inactivity_timeout_value=15_minutes
 journald_compress
 journald_storage
+kernel_module_atm_disabled
+kernel_module_can_disabled
+kernel_module_cramfs_disabled
+kernel_module_dccp_disabled
+kernel_module_firewire-core_disabled
+kernel_module_freevxfs_disabled
+kernel_module_hfs_disabled
+kernel_module_hfsplus_disabled
+kernel_module_jffs2_disabled
+kernel_module_overlayfs_disabled
+kernel_module_rds_disabled
 kernel_module_sctp_disabled
 kernel_module_squashfs_disabled
 kernel_module_tipc_disabled
@@ -264,6 +278,7 @@ no_empty_passwords_etc_shadow
 no_files_unowned_by_user
 no_forward_files
 no_netrc_files
+no_nologin_in_shells
 no_password_auth_for_systemaccounts
 no_shelllogin_for_systemaccounts
 package_aide_installed
@@ -282,7 +297,6 @@ package_kea_removed
 package_libselinux_installed
 package_mcstrans_removed
 package_net-snmp_removed
-package_nftables_installed
 package_nginx_removed
 package_openldap-clients_removed
 package_pam_pwquality_installed
@@ -316,11 +330,11 @@ service_auditd_enabled
 service_autofs_disabled
 service_avahi-daemon_disabled
 service_bluetooth_disabled
+service_cockpit_disabled
 service_crond_enabled
 service_cups_disabled
 service_firewalld_enabled
 service_nfs_disabled
-service_nftables_disabled
 service_rpcbind_disabled
 service_systemd-journald_enabled
 set_password_hashing_algorithm_libuserconf
@@ -329,6 +343,7 @@ set_password_hashing_algorithm_passwordauth
 set_password_hashing_algorithm_systemauth
 socket_systemd-journal-remote_disabled
 sshd_disable_empty_passwords
+sshd_disable_forwarding
 sshd_disable_gssapi_auth
 sshd_disable_rhosts
 sshd_disable_root_login
@@ -345,20 +360,26 @@ sshd_set_loglevel_verbose
 sshd_set_max_auth_tries
 sshd_set_max_sessions
 sshd_set_maxstartups
-sshd_strong_kex=cis_rhel8
-sshd_strong_macs=cis_rhel8
+sshd_strong_kex=cis_rhel10
+sshd_strong_macs=cis_rhel10
 sshd_use_strong_kex
 sshd_use_strong_macs
 sudo_add_use_pty
 sudo_custom_logfile
 sudo_require_authentication
 sudo_require_reauthentication
+sysctl_fs_protected_hardlinks
+sysctl_fs_protected_symlinks
+sysctl_fs_suid_dumpable
+sysctl_kernel_dmesg_restrict
+sysctl_kernel_kptr_restrict
 sysctl_kernel_randomize_va_space
 sysctl_kernel_yama_ptrace_scope
 sysctl_net_ipv4_conf_all_accept_redirects
 sysctl_net_ipv4_conf_all_accept_redirects_value=disabled
 sysctl_net_ipv4_conf_all_accept_source_route
 sysctl_net_ipv4_conf_all_accept_source_route_value=disabled
+sysctl_net_ipv4_conf_all_forwarding
 sysctl_net_ipv4_conf_all_log_martians
 sysctl_net_ipv4_conf_all_log_martians_value=enabled
 sysctl_net_ipv4_conf_all_rp_filter
@@ -398,6 +419,8 @@ sysctl_net_ipv6_conf_default_accept_redirects
 sysctl_net_ipv6_conf_default_accept_redirects_value=disabled
 sysctl_net_ipv6_conf_default_accept_source_route
 sysctl_net_ipv6_conf_default_accept_source_route_value=disabled
+sysctl_net_ipv6_conf_default_forwarding
+sysctl_net_ipv6_conf_default_forwarding_value=disabled
 use_pam_wheel_group_for_su
 var_account_disable_post_pw_expiration=30
 var_accounts_maximum_age_login_defs=365
@@ -409,12 +432,12 @@ var_accounts_passwords_pam_faillock_unlock_time=900
 var_accounts_tmout=15_min
 var_accounts_user_umask=027
 var_auditd_action_mail_acct=root
-var_auditd_admin_space_left_action=cis_rhel8
-var_auditd_disk_error_action=cis_rhel8
-var_auditd_disk_full_action=cis_rhel8
+var_auditd_admin_space_left_action=cis_rhel10
+var_auditd_disk_error_action=cis_rhel10
+var_auditd_disk_full_action=cis_rhel10
 var_auditd_max_log_file=6
 var_auditd_max_log_file_action=keep_logs
-var_auditd_space_left_action=cis_rhel8
+var_auditd_space_left_action=cis_rhel10
 var_authselect_profile=local
 var_multiple_time_servers=rhel
 var_pam_wheel_group_for_su=cis