simpl.
Sign in
Cybersecurity GRC 15 items

Kubernetes & Container Security Hardening

Assesses hardening of container images, workloads, and the Kubernetes control plane against NIST 800-190 and the NSA/CISA Kubernetes hardening guidance.

CIS Kubernetes BenchmarkNIST 800-190NSA/CISA K8s

Free PDF · enter your email to download.

Image & Supply Chain

  • Are container images built from minimal, trusted base images? *
  • Are images scanned for vulnerabilities in the pipeline and registry? *
  • Are image signatures verified and only trusted registries allowed? *
  • Do containers run as non-root users? *

Workload & Pod Security

  • Are Pod Security Standards (restricted) or admission controllers enforced? *
  • Are privileged containers and host namespace sharing prohibited? *
  • Are resource requests and limits set to prevent resource exhaustion? *
  • Are read-only root filesystems used where possible?

Access & Network Controls

  • Is RBAC configured with least-privilege service accounts? *
  • Are network policies applied to restrict pod-to-pod traffic? *
  • Is access to the Kubernetes API server authenticated and TLS-protected? *
  • Are secrets stored in a secrets manager rather than plain manifests? *

Runtime & Monitoring

  • Is runtime threat detection deployed to detect anomalous container behavior? *
  • Are audit logs enabled on the control plane and shipped to central storage? *
  • Are worker nodes and the control plane patched and hardened to a benchmark? *

Download the full Kubernetes & Container Security Hardening checklist

Get it as a clean, printable PDF — free.