The CIS certified policy for Google Chrome is based on the CIS Benchmark for MacOS Safari, v2.0.0.

The policy contains Scored types of

Level 1 and Level 2 checks from the benchmark. The controls within the policy are configured on the basis of values provided by the CIS
benchmark. As this policy and the controls within the policy are certified by CIS, the policy is LOCKED for prohibiting any changes to the
controls or their configuration values. If the organizational security policy requires different configuration values or changes to the policy,
please make a copy of this policy and modify the configured values for the required controls as per the need of the organization's security/
configuration policy.

In the case of CIS-required Control duplication (where a Control requirement appears in more than one section of the benchmark), Qualys
Policy Compliance Policy Editor limits the existence of any Controls within a single policy to one (1) occurrence of each control.

CIS has stated that these settings should be considered as minimum allowable values; if an Organization requires more stringency than the
CIS minimum, these more restrictive and/or stringent values shall all be considered as a PASS. The settings assigned to any given control by
CIS are not guaranteed to be appropriate for any particular environment and all settings should be reviewed and applied according to the
needs of the business. Before you apply the recommendations from the policy, check the relevant vendor documentation to avoid
discrepancies. Also, it is recommended that these values be tested before applying to the Production Environment.

CAUTION: The above OS configuration requirements may vary or unnecessary depending on the Customers' requirements. However, it is
important to note that multiple unsuccessful authentications during the scans could result in LOCKING OUT the built-in administrative user, or
the user account used in running the scans.

Hardening (Web Browser) Safari page 1

Hardening (Web Browser) Safari
August 21, 2020

Report Summary
Created: 08/21/2020 at 11:57:41 (GMT-0500)
Company: AXA Colpatria
Address: Cra 7 No 24 - 89
City: Bogotá
Zip: 110311
Country: Colombia
User Name: Santiago Adolfo García Giraldo
Login Name: axacp2sg
User Role: Manager

Report Summary

Policy: MTSB-Safari12
Policy Locking: Locked - CIS Certified Policy
Template: Policy Report Template
Asset Groups:
Ips: 10.65.99.220
Asset Tags: N/A
PC Agent IPs: No
Active Hosts: 0
Controls: 10
Technologies: 2 (Apple Safari 11.x, Apple Safari 12.x)

Total Control Instances: 0

Total Passed: 0
Total Failed: 0
Total Error: 0
Approved Exceptions: 0
Pending Exceptions: 0
Policy Modified: 07/09/2020 at 15:28:58 (GMT-0500)
Policy Last Evaluated: 07/27/2020 at 15:57:42 (GMT-0500)

Hardening (Web Browser) Safari page 2

The following pie charts display the number of control instances and their states at the time this report was generated.

Pass/Fail/Error Summary Pass/Fail/Error and Exceptions Summary

Pass Criticality Summary Fail Criticality Summary

Hardening (Web Browser) Safari page 3

Control Statistics (Percentage of Hosts Passed per Control)

1. General

Order Control ID Statement % Criticality

1.1 14205 Status of the 'open safe download (AutoOpenSafeDownloads)' setting N/A CRITICAL
2. AutoFill

Order Control ID Statement % Criticality

2.1 14206 Status of the 'AutoFill user names and passwords [AutoFillPasswords]' setting N/A CRITICAL
2.2 14207 Status of the 'AutoFill Credit cards [AutoFillCreditCardData]' setting N/A CRITICAL
2.3 14208 Status of the 'AutoFill Miscellaneous Forms' setting N/A CRITICAL
3. Security

Order Control ID Statement % Criticality

3.1 14209 Status of the 'Warn About Fraudulent Websites' setting N/A SERIOUS
3.2 14210 Status of the 'Enable JavaScript [WebKitJavaScriptEnabled]' setting N/A SERIOUS
3.3 14212 Status of the 'Block pop-up windows' setting N/A SERIOUS
4. Privacy

Order Control ID Statement % Criticality

4.1 14213 Status of the 'Block Storage Policy' setting N/A SERIOUS
5. Advanced

Order Control ID Statement % Criticality

5.1 14214 Status of the 'Show full website address' setting N/A SERIOUS
6. Other

Order Control ID Statement % Criticality

6.1 14215 Status of the 'Show Status Bar' setting N/A SERIOUS

Hardening (Web Browser) Safari page 4

Host Statistics (Percentage of Controls Passed per Host)

No results found.

Hardening (Web Browser) Safari page 5

Detailed Results

Hardening (Web Browser) Safari page 6

Appendix

Report Template

Policy Report Template

Template Settings
Time Frame: None
Trend Duration: Last 90 days
Group By: Hosts
Status: Passed, Failed and Error
Criticality: UNDEFINED, MINIMAL, MEDIUM, SERIOUS, CRITICAL, URGENT
Control Statistics: Yes
Host Statistics: Yes
Show Report details: Yes
Show control rationale: Yes
Show hosts summary: Yes
Show control evidence: Yes
Show extended evidence (if applicable): Yes
Show control exceptions: Yes
Show exception history: Yes
Show cause of failure: No
Show control glossary: No
Show Appendix: Yes
Frameworks selected: All

CONFIDENTIAL AND PROPRIETARY INFORMATION.

Qualys provides the QualysGuard Service "As Is," without any warranty of any kind. Qualys makes no warranty that the information contained in this report is
complete or error-free. Copyright 2020, Qualys, Inc.

Hardening (Web Browser) Safari page 7