<?xml version="1.0" encoding="UTF-8"?>
<!-- ToTheNOC tailoring of CIS Debian 13 Level 1 Server (ComplianceAsCode 0.1.82, ssg-debian13-ds).
     The upstream profile selects mutually exclusive CIS alternatives at once (chrony enabled AND disabled, journald forwarding AND not forwarding to syslog).
     TTN choice: time = chrony (Amazon Time Sync 169.254.169.123), logs = persistent journald only (as on the EL images).
     Firewall: the Debian profile requires ufw only (no alternatives) -> nothing deselected.
     v2: remote journal upload targets the CUSTOMER's log collector -> deselected; the package stays installed, the service disabled
     (enable with: sudo ttn-journal-upload <URL>). Reasons on the evidence page. -->
<xccdf-1.2:Tailoring xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" id="xccdf_ro.tothenoc_tailoring_debian13">
  <xccdf-1.2:benchmark href="/usr/share/ttn/ssg-debian13-ds.xml"/>
  <xccdf-1.2:version time="2026-10-25T21:50:00">2</xccdf-1.2:version>
  <xccdf-1.2:Profile id="xccdf_ro.tothenoc_profile_cis_level1_server_ttn" extends="xccdf_org.ssgproject.content_profile_cis_level1_server">
    <xccdf-1.2:title>TTN: CIS Debian Benchmark Level 1 Server (chrony + journald; remote journal upload left to the customer)</xccdf-1.2:title>
    <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_systemd-journal-upload_enabled" selected="false"/>
    <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_systemd_journal_upload_url" selected="false"/>
    <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_chronyd_disabled" selected="false"/>
    <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_timesyncd_installed" selected="false"/>
    <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_timesyncd_configured" selected="false"/>
    <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_timesyncd_enabled" selected="false"/>
    <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_journald_forward_to_syslog" selected="false"/>
    <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_rsyslog_installed" selected="false"/>
    <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_filecreatemode" selected="false"/>
    <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_nolisten" selected="false"/>
    <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_rsyslog_enabled" selected="false"/>
  </xccdf-1.2:Profile>
</xccdf-1.2:Tailoring>
