diff --git a/ansible/playbook_hardening.yml b/ansible/playbook_hardening.yml
index 2224dd1..985c785 100644
--- a/ansible/playbook_hardening.yml
+++ b/ansible/playbook_hardening.yml
@@ -19,8 +19,6 @@
       tags:
         - roles
         - roles::cis
-        - roles::cis::ufw
-        - roles::cis::sysctl
     - role: "fail2ban"
       tags:
         - roles
diff --git a/ansible/roles/cis_hardening/defaults/main/sshd.yml b/ansible/roles/cis_hardening/defaults/main/sshd.yml
index 9ea3268..9131071 100644
--- a/ansible/roles/cis_hardening/defaults/main/sshd.yml
+++ b/ansible/roles/cis_hardening/defaults/main/sshd.yml
@@ -15,7 +15,7 @@ sshd_client_alive_interval: 200
 sshd_compression: "no"
 sshd_gssapi_authentication: "no"
 sshd_hostbased_authentication: "no"
-sshd_host_key_algorithms: ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ssh-rsa,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256
+sshd_host_key_algorithms: ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ssh-rsa,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com
 sshd_ignore_user_known_hosts: "yes"
 sshd_kerberos_authentication: "no"
 sshd_kex_algorithms: curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
diff --git a/ansible/roles/cis_hardening/tasks/main.yml b/ansible/roles/cis_hardening/tasks/main.yml
index a148ceb..559d6b7 100644
--- a/ansible/roles/cis_hardening/tasks/main.yml
+++ b/ansible/roles/cis_hardening/tasks/main.yml
@@ -20,9 +20,13 @@
   when: ufw_enable
   tags:
     - ufw
+    - roles::cis::ufw
 
 - name: Configure sysctl
   ansible.builtin.include_tasks: sysctl.yml
+  tags:
+    - sysctl
+    - roles::cis::sysctl
 
 - name: Disable kernel network modules
   ansible.builtin.include_tasks: disablenet.yml
@@ -76,6 +80,10 @@
 
 - name: Configure ssh server and client
   ansible.builtin.include_tasks: sshconfig.yml
+  tags:
+    - ssh
+    - sshd
+    - roles::cis::sshd
 
 - name: Configure PAM
   ansible.builtin.include_tasks: password.yml
diff --git a/ansible/roles/cis_hardening/tasks/sshconfig.yml b/ansible/roles/cis_hardening/tasks/sshconfig.yml
index 9536dc1..1e2fa03 100644
--- a/ansible/roles/cis_hardening/tasks/sshconfig.yml
+++ b/ansible/roles/cis_hardening/tasks/sshconfig.yml
@@ -6,6 +6,7 @@
   failed_when: false
   register: ssh_version
   tags:
+    - roles::cis::sshd
     - sshd
     - sshd_config
 
@@ -13,6 +14,7 @@
   ansible.builtin.set_fact:
     ssh_installed_version: "{{ ssh_version.stderr | regex_search('^OpenSSH_([0-9+].[0-9]+)', '\\1') | join('.') | float }}" # noqa jinja[spacing]
   tags:
+    - roles::cis::sshd
     - sshd
     - sshd_config
 
@@ -21,6 +23,7 @@
     path: /etc/sysconfig/sshd
   register: sysconfig_sshd
   tags:
+    - roles::cis::sshd
     - sshd
     - sshd_config
     - M1041
@@ -33,6 +36,7 @@
     regexp: ^\s*CRYPTO_POLICY.*$
   when: sysconfig_sshd.stat.exists
   tags:
+    - roles::cis::sshd
     - sshd
     - CCE-80939-2
     - M1041
@@ -44,6 +48,7 @@
   changed_when: false
   failed_when: false
   tags:
+    - roles::cis::sshd
     - sshd
     - sshd_config
     - M1041
@@ -53,6 +58,7 @@
     path: /etc/ssh/sshd_config.d
   register: sshd_config_d
   tags:
+    - roles::cis::sshd
     - sshd
     - sshd_config
     - M1041
@@ -65,6 +71,7 @@
     group: root
     mode: "0600"
   tags:
+    - roles::cis::sshd
     - sshd
     - sshd_config
 
@@ -83,6 +90,7 @@
     - Restart sshd service
     - Restart ssh service
   tags:
+    - roles::cis::sshd
     - sshd
     - sshd_config
     - CCE-80895-6
@@ -137,6 +145,7 @@
     - Restart sshd service
     - Restart ssh service
   tags:
+    - roles::cis::sshd
     - sshd
     - sshd_config
     - CCE-80895-6
@@ -184,6 +193,7 @@
     state: absent
   when: sshd_config_d.stat.exists and grep_include.rc == 0
   tags:
+    - roles::cis::sshd
     - sshd
     - sshd_config
 
@@ -196,6 +206,7 @@
     excludes: "*.pub"
   register: ssh_host_keys
   tags:
+    - roles::cis::sshd
     - sshd
     - M1022
     - M1041
@@ -211,6 +222,7 @@
   loop_control:
     label: "{{ item.path }}"
   tags:
+    - roles::cis::sshd
     - sshd
     - CCE-82424-3
     - CIS-UBUNTU2004-5.3.2
@@ -222,6 +234,7 @@
     path: /etc/ssh/ssh_config.d
   register: ssh_config_d
   tags:
+    - roles::cis::ssh
     - ssh
     - ssh_config
     - M1041
@@ -236,6 +249,7 @@
     owner: root
     group: root
   tags:
+    - roles::cis::ssh
     - ssh
     - ssh_config
     - CCE-82880-6