diff --git a/tests/hardening/3.1.1_disable_ipv6.sh b/tests/hardening/3.1.1_disable_ipv6.sh
index f85b20d..78c6caf 100644
--- a/tests/hardening/3.1.1_disable_ipv6.sh
+++ b/tests/hardening/3.1.1_disable_ipv6.sh
@@ -7,5 +7,23 @@ test_audit() {
     # shellcheck disable=2154
     run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
-    # TODO fill comprehensive tests
+    if [ -f "/.dockerenv" ]; then
+        skip "SKIPPED on docker"
+    else
+        describe Tests purposely failing
+        sysctl -w net.ipv6.conf.all.disable_ipv6=0 2>/dev/null
+        register_test retvalshouldbe 1
+        register_test contain "net.ipv6.conf.all.disable_ipv6 was not set to 1"
+        run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+
+        describe correcting situation
+        sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
+        /opt/debian-cis/bin/hardening/"${script}".sh --apply || true
+
+        describe Checking resolved state
+        register_test retvalshouldbe 0
+        register_test contain "correctly set to 1"
+        register_test contain "net.ipv6.conf.all.disable_ipv6 correctly set to 0"
+        run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+    fi
 }
diff --git a/tests/hardening/3.2.1_disable_send_packet_redirects.sh b/tests/hardening/3.2.1_disable_send_packet_redirects.sh
index f85b20d..9c90955 100644
--- a/tests/hardening/3.2.1_disable_send_packet_redirects.sh
+++ b/tests/hardening/3.2.1_disable_send_packet_redirects.sh
@@ -7,5 +7,23 @@ test_audit() {
     # shellcheck disable=2154
     run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
-    # TODO fill comprehensive tests
+    if [ -f "/.dockerenv" ]; then
+        skip "SKIPPED on docker"
+    else
+        describe Tests purposely failing
+        sysctl -w net.ipv4.conf.all.send_redirects=1 2>/dev/null
+        register_test retvalshouldbe 1
+        register_test contain "net.ipv4.conf.all.send_redirects was not set to 0"
+        run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+
+        describe correcting situation
+        sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
+        /opt/debian-cis/bin/hardening/"${script}".sh --apply || true
+
+        describe Checking resolved state
+        register_test retvalshouldbe 0
+        register_test contain "correctly set to 0"
+        register_test contain "net.ipv4.conf.all.send_redirects correctly set to 0"
+        run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+    fi
 }
diff --git a/tests/hardening/3.3.1_disable_source_routed_packets.sh b/tests/hardening/3.3.1_disable_source_routed_packets.sh
index f85b20d..ba30f84 100644
--- a/tests/hardening/3.3.1_disable_source_routed_packets.sh
+++ b/tests/hardening/3.3.1_disable_source_routed_packets.sh
@@ -7,5 +7,30 @@ test_audit() {
     # shellcheck disable=2154
     run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
-    # TODO fill comprehensive tests
+    if [ -f "/.dockerenv" ]; then
+        skip "SKIPPED on docker"
+    else
+        describe Tests purposely failing
+        sysctl -w net.ipv4.conf.all.accept_source_route=1 net.ipv4.conf.default.accept_source_route=1 net.ipv6.conf.all.accept_source_route=1 net.ipv6.conf.default.accept_source_route=1 2>/dev/null
+        register_test retvalshouldbe 1
+        register_test contain "net.ipv4.conf.all.accept_source_route was not set to 0"
+        register_test contain "net.ipv4.conf.default.accept_source_route was not set to 0"
+        register_test contain "net.ipv6.conf.all.accept_source_route was not set to 0"
+        register_test contain "net.ipv6.conf.default.accept_source was not set to 0"
+
+        run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+
+        describe correcting situation
+        sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
+        /opt/debian-cis/bin/hardening/"${script}".sh --apply || true
+
+        describe Checking resolved state
+        register_test retvalshouldbe 0
+        register_test contain "correctly set to 0"
+        register_test contain "net.ipv4.conf.all.accept_source_route correctly set to 0"
+        register_test contain "net.ipv4.conf.default.accept_source_route correctly set to 0"
+        register_test contain "net.ipv6.conf.all.accept_source_route correctly set to 0"
+        register_test contain "net.ipv6.conf.default.accept_source correctly set to 0"
+        run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+    fi
 }
diff --git a/tests/hardening/3.3.2_disable_icmp_redirect.sh b/tests/hardening/3.3.2_disable_icmp_redirect.sh
index f85b20d..c83cbaa 100644
--- a/tests/hardening/3.3.2_disable_icmp_redirect.sh
+++ b/tests/hardening/3.3.2_disable_icmp_redirect.sh
@@ -7,5 +7,30 @@ test_audit() {
     # shellcheck disable=2154
     run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
-    # TODO fill comprehensive tests
+    if [ -f "/.dockerenv" ]; then
+        skip "SKIPPED on docker"
+    else
+        describe Tests purposely failing
+        sysctl -w net.ipv4.conf.all.accept_redirects=1 net.ipv4.conf.default.accept_redirects=1 net.ipv6.conf.all.accept_redirects=1 net.ipv6.conf.default.accept_redirects=1 2>/dev/null
+        register_test retvalshouldbe 1
+        register_test contain "net.ipv4.conf.all.accept_redirects was not set to 0"
+        register_test contain "net.ipv4.conf.default.accept_redirects was not set to 0"
+        register_test contain "net.ipv6.conf.all.accept_redirects was not set to 0"
+        register_test contain "net.ipv6.conf.default.accept_redirects was not set to 0"
+
+        run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+
+        describe correcting situation
+        sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
+        /opt/debian-cis/bin/hardening/"${script}".sh --apply || true
+
+        describe Checking resolved state
+        register_test retvalshouldbe 0
+        register_test contain "correctly set to 0"
+        register_test contain "net.ipv4.conf.all.accept_redirects correctly set to 0"
+        register_test contain "net.ipv4.conf.default.accept_redirects correctly set to 0"
+        register_test contain "net.ipv6.conf.all.accept_redirects correctly set to 0"
+        register_test contain "net.ipv6.conf.default.accept_redirects correctly set to 0"
+        run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+    fi
 }
diff --git a/tests/hardening/3.3.3_disable_secure_icmp_redirect.sh b/tests/hardening/3.3.3_disable_secure_icmp_redirect.sh
index f85b20d..688137a 100644
--- a/tests/hardening/3.3.3_disable_secure_icmp_redirect.sh
+++ b/tests/hardening/3.3.3_disable_secure_icmp_redirect.sh
@@ -7,5 +7,26 @@ test_audit() {
     # shellcheck disable=2154
     run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
-    # TODO fill comprehensive tests
+    if [ -f "/.dockerenv" ]; then
+        skip "SKIPPED on docker"
+    else
+        describe Tests purposely failing
+        sysctl -w net.ipv4.conf.all.secure_redirects=1 net.ipv4.conf.default.secure_redirects=1 2>/dev/null
+        register_test retvalshouldbe 1
+        register_test contain "net.ipv4.conf.all.secure_redirects was not set to 0"
+        register_test contain "net.ipv4.conf.default.secure_redirects=0 was not set to 0"
+
+        run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+
+        describe correcting situation
+        sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
+        /opt/debian-cis/bin/hardening/"${script}".sh --apply || true
+
+        describe Checking resolved state
+        register_test retvalshouldbe 0
+        register_test contain "correctly set to 0"
+        register_test contain "net.ipv4.conf.all.secure_redirects correctly set to 0"
+        register_test contain "net.ipv4.conf.default.secure_redirects correctly set to 0"
+        run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+    fi
 }
diff --git a/tests/hardening/3.3.4_log_martian_packets.sh b/tests/hardening/3.3.4_log_martian_packets.sh
index f85b20d..4dbbafe 100644
--- a/tests/hardening/3.3.4_log_martian_packets.sh
+++ b/tests/hardening/3.3.4_log_martian_packets.sh
@@ -7,5 +7,26 @@ test_audit() {
     # shellcheck disable=2154
     run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
-    # TODO fill comprehensive tests
+    if [ -f "/.dockerenv" ]; then
+        skip "SKIPPED on docker"
+    else
+        describe Tests purposely failing
+        sysctl -w net.ipv4.conf.all.log_martians=0 net.ipv4.conf.default.log_martians=0 2>/dev/null
+        register_test retvalshouldbe 1
+        register_test contain "net.ipv4.conf.all.log_martians was not set to 1"
+        register_test contain "net.ipv4.conf.default.log_martians was not set to 1"
+
+        run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+
+        describe correcting situation
+        sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
+        /opt/debian-cis/bin/hardening/"${script}".sh --apply || true
+
+        describe Checking resolved state
+        register_test retvalshouldbe 0
+        register_test contain "correctly set to 1"
+        register_test contain "net.ipv4.conf.all.log_martians correctly set to 1"
+        register_test contain " net.ipv4.conf.default.log_martians correctly set to 1"
+        run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+    fi
 }
diff --git a/tests/hardening/3.3.5_ignore_broadcast_requests.sh b/tests/hardening/3.3.5_ignore_broadcast_requests.sh
index f85b20d..a88ac4a 100644
--- a/tests/hardening/3.3.5_ignore_broadcast_requests.sh
+++ b/tests/hardening/3.3.5_ignore_broadcast_requests.sh
@@ -7,5 +7,24 @@ test_audit() {
     # shellcheck disable=2154
     run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
-    # TODO fill comprehensive tests
+    if [ -f "/.dockerenv" ]; then
+        skip "SKIPPED on docker"
+    else
+        describe Tests purposely failing
+        sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=0 2>/dev/null
+        register_test retvalshouldbe 1
+        register_test contain "net.ipv4.icmp_echo_ignore_broadcasts was not set to 1"
+
+        run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+
+        describe correcting situation
+        sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
+        /opt/debian-cis/bin/hardening/"${script}".sh --apply || true
+
+        describe Checking resolved state
+        register_test retvalshouldbe 0
+        register_test contain "correctly set to 1"
+        register_test contain "net.ipv4.icmp_echo_ignore_broadcasts correctly set to 1"
+        run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+    fi
 }
diff --git a/tests/hardening/3.3.6_enable_bad_error_message_protection.sh b/tests/hardening/3.3.6_enable_bad_error_message_protection.sh
index f85b20d..1aa17eb 100644
--- a/tests/hardening/3.3.6_enable_bad_error_message_protection.sh
+++ b/tests/hardening/3.3.6_enable_bad_error_message_protection.sh
@@ -7,5 +7,24 @@ test_audit() {
     # shellcheck disable=2154
     run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
-    # TODO fill comprehensive tests
+    if [ -f "/.dockerenv" ]; then
+        skip "SKIPPED on docker"
+    else
+        describe Tests purposely failing
+        sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=0 2>/dev/null
+        register_test retvalshouldbe 1
+        register_test contain "net.ipv4.icmp_ignore_bogus_error_responses was not set to 1"
+
+        run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+
+        describe correcting situation
+        sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
+        /opt/debian-cis/bin/hardening/"${script}".sh --apply || true
+
+        describe Checking resolved state
+        register_test retvalshouldbe 0
+        register_test contain "correctly set to 0"
+        register_test contain "net.ipv4.icmp_ignore_bogus_error_responses correctly set to 0"
+        run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+    fi
 }
diff --git a/tests/hardening/3.3.7_enable_source_route_validation.sh b/tests/hardening/3.3.7_enable_source_route_validation.sh
index f85b20d..16c04d7 100644
--- a/tests/hardening/3.3.7_enable_source_route_validation.sh
+++ b/tests/hardening/3.3.7_enable_source_route_validation.sh
@@ -7,5 +7,26 @@ test_audit() {
     # shellcheck disable=2154
     run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
-    # TODO fill comprehensive tests
+    if [ -f "/.dockerenv" ]; then
+        skip "SKIPPED on docker"
+    else
+        describe Tests purposely failing
+        sysctl -w net.ipv4.conf.all.rp_filter=0 net.ipv4.conf.default.rp_filter=0 2>/dev/null
+        register_test retvalshouldbe 1
+        register_test contain "net.ipv4.conf.all.rp_filter was not set to 1"
+        register_test contain "net.ipv4.conf.default.rp_filter was not set to 1"
+
+        run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+
+        describe correcting situation
+        sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
+        /opt/debian-cis/bin/hardening/"${script}".sh --apply || true
+
+        describe Checking resolved state
+        register_test retvalshouldbe 0
+        register_test contain "correctly set to 1"
+        register_test contain "net.ipv4.conf.all.rp_filter correctly set to 1"
+        register_test contain "net.ipv4.conf.default.rp_filter correctly set to 1"
+        run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+    fi
 }
diff --git a/tests/hardening/3.3.8_enable_tcp_syn_cookies.sh b/tests/hardening/3.3.8_enable_tcp_syn_cookies.sh
index f85b20d..a45c03d 100644
--- a/tests/hardening/3.3.8_enable_tcp_syn_cookies.sh
+++ b/tests/hardening/3.3.8_enable_tcp_syn_cookies.sh
@@ -7,5 +7,25 @@ test_audit() {
     # shellcheck disable=2154
     run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
-    # TODO fill comprehensive tests
+    if [ -f "/.dockerenv" ]; then
+        skip "SKIPPED on docker"
+    else
+        describe Tests purposely failing
+        sysctl -w net.ipv4.tcp_syncookies=0 2>/dev/null
+        register_test retvalshouldbe 1
+        register_test contain "net.ipv4.tcp_syncookies was not set to 1"
+
+        run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+
+        describe correcting situation
+        sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
+        /opt/debian-cis/bin/hardening/"${script}".sh --apply || true
+
+        describe Checking resolved state
+        register_test retvalshouldbe 0
+        register_test contain "correctly set to 1"
+        register_test contain "net.ipv4.tcp_syncookies correctly set to 1"
+
+        run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+    fi
 }
diff --git a/tests/hardening/3.3.9_disable_ipv6_router_advertisement.sh b/tests/hardening/3.3.9_disable_ipv6_router_advertisement.sh
index f85b20d..f424d6e 100644
--- a/tests/hardening/3.3.9_disable_ipv6_router_advertisement.sh
+++ b/tests/hardening/3.3.9_disable_ipv6_router_advertisement.sh
@@ -7,5 +7,26 @@ test_audit() {
     # shellcheck disable=2154
     run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
-    # TODO fill comprehensive tests
+    if [ -f "/.dockerenv" ]; then
+        skip "SKIPPED on docker"
+    else
+        describe Tests purposely failing
+        sysctl -w net.ipv6.conf.all.accept_ra=1 net.ipv6.conf.default.accept_ra=1 2>/dev/null
+        register_test retvalshouldbe 1
+        register_test contain " net.ipv6.conf.all.accept_ra was not set to 0"
+        register_test contain "net.ipv6.conf.default.accept_ra was not set to 0"
+
+        run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+
+        describe correcting situation
+        sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
+        /opt/debian-cis/bin/hardening/"${script}".sh --apply || true
+
+        describe Checking resolved state
+        register_test retvalshouldbe 0
+        register_test contain "correctly set to 0"
+        register_test contain "net.ipv6.conf.all.accept_ra correctly set to 0"
+        register_test contain "net.ipv6.conf.default.accept_ra correctly set to 0"
+        run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+    fi
 }