CIS BENCHMARK AUDIT

A CIS Benchmark Audit is conducted as follows:
 

1. Preparation and Planning:

• Identify the scope and the requirements to get started
   

2. Benchmark Assessment Compliance:

• Review the specific CIS benchmark documents relevant to the audited systems and platforms

• Compare the configurations and settings of the assets in the inventory to the recommended benchmarks

• Identify any deviations from the benchmarks and document them
   

3. Vulnerability Identification:

• Analyze the deviations from the CIS benchmarks to identify potential vulnerabilities and security weaknesses

• Assess the severity and potential impact of each identified vulnerability.
   

4. Documentation and Reporting:

• Create detailed reports that include findings, deviations from CIS benchmarks and the identified vulnerabilities

• Provide recommendations and remediation steps for addressing the identified issues.

• Include evidence and supporting documentation for each finding
   

5. Verification and Validation:

• After remediation, verify that the identified vulnerabilities have been addressed and configurations have been brought into compliance with CIS benchmarks

• Validate that the implemented changes do not introduce new security issues