We are aware of the fact that the list of security settings identified is not complete and may become outdated for new versions of the operating systems.
Nevertheless, the pro- posed set is based on the well-known benchmarks from CIS, complemented with several settings defined by the authors.
A key aspect is that adding new settings to the list (or revising existing ones) is a task that would basically consist of repeating the same steps performed in this work.
The major issue at this point is automation, as already referred for a considerable set of settings defined in the CIS documents, for which advanced solutions need to be researched in the future (e.g. the integration of security assessment in the operating system itself).