domains / families / security / cis-benchmarks

cis-benchmarks

combined

Audit and remediate CIS benchmark violations. Use automated tools to assess compliance and implement hardening recommendations. Use when meeting compliance requirements or implementing security baselines. Audit and remediate CIS benchmark violations.

When to use

• Assessing security compliance
• Implementing security baselines
• Meeting regulatory requirements
• Hardening systems to standards

When not to use

• An OpenSCAP/Lynis assessment may require privileges and read sensitive host configuration; approve the exact host, profile, privileges, private outputs and limits first. Do not enable auto-remediation or mount all host paths without review…
• Benchmark/profile identifiers and installed SCAP content vary; use [OpenSCAP’s documented info/eval flow](https://static.open-scap.org/openscap-1.4.1/oscap_user_manual.html). Test changes and preserve rollback/access before hardening produ…
• Docs-only import: upstream scripts and templates not bundled.

Skill page

Conflict

The second copy is a safety-hardened adaptation of the first, but it changes the operational procedure in ways that would hide a real alternative if one copy were crowned. The first copy provides concrete, runnable commands (hardcoded CIS profile ID, specific kube-bench check sections, fixed report paths). The second copy replaces those with variable-driven, approval-gated steps (oscap info to discover profile, reviewed image digest, private audit directory, explicit limitations and read-only inventory). Because the copies disagree on how to select the OpenSCAP profile, how to pin the kube-bench image, and where to write reports, crowning one would discard the other's material constraints.