An XCCDF Rule
/boot/config-*
CONFIG_UNMAP_KERNEL_AT_EL0
grep CONFIG_UNMAP_KERNEL_AT_EL0 /boot/config-*