cis-cat audit

cis-cat.sh -a -b <benchmark>

Audits a system against the CIS Benchmark with CIS-CAT, generating the compliance report of CIS recommendations.

Run it when you need a compliance audit against CIS: CIS-CAT evaluates the system against the CIS benchmark (Windows, Linux, macOS, cloud) and generates the report with the compliance percentage, the passed controls, and the failed ones with their recommendation. It's the reference tool for hardening audits: the starting point of the hardening work (which controls fail) and the evidence of progress (the score rises with each remediation). In the organization's hardening program, CIS-CAT is the measurement: the per-host report is consolidated and failed controls are prioritized by risk.

Don't use it as a security verdict: the CIS benchmark measures configuration compliance, not real security — a system with 100% CIS can be compromised (and one with failures can be healthy). Benchmarks are generic: controls that don't apply to the host's role (a web server with workstation controls) penalize the score without benefit — the benchmark profile is chosen with the role. And watch out for scope and performance: the full audit (with registry and file controls) takes time and some controls touch the system (broad reads); in production, the audit is scheduled. The CIS-CAT license (free for members, paid for commercial use) is reviewed beforehand.