CIS Benchmarks are a build standard, not a document

The CIS Benchmark for Linux is several hundred pages of specific, testable configuration guidance, and it is one of the most useful documents in security — provided it becomes a build standard rather than a project. Applied by hand to a running server, it drifts within weeks. Applied in code to the image every server is built from, it holds.

Understand what each family prevents

Working through the benchmark blindly produces a hardened system nobody can support. The control families map to recognisable attacker steps: filesystem and mount options limit where code can execute, service minimisation shrinks the reachable surface, kernel parameters remove network tricks, PAM and password policy protect authentication, and auditd provides the record you will want during an incident. Knowing which step a control interrupts makes exception decisions defensible.

Ubuntu and RHEL diverge more than expected

• Different default service sets, so minimisation differs meaningfully.
• AppArmor on Ubuntu versus SELinux on RHEL — genuinely different mental models.
• Package tooling and update policies affect how you evidence patch levels.
• Ubuntu Security Guide and OpenSCAP overlap but produce different reports, and auditors will ask which you used.

Automate remediation or accept drift

Ansible is the pragmatic choice: idempotent, readable by auditors, and able to prove that a control is enforced on every run rather than asserted once. The pattern that works is a hardening role applied at build, re-applied on a schedule, with scan results stored over time so you can show a trend rather than a snapshot.

Exceptions are normal; undocumented exceptions are findings

Some controls will break an application. That is expected. What matters is that the exception is recorded with a reason, a compensating control and a review date. A benchmark score of 92 percent with eight documented exceptions is a stronger position than 100 percent achieved by disabling the scanner check.

The compliance dividend

Benchmark evidence maps directly to configuration-management requirements in ISO 27001, SOC 2, CMMC and PCI DSS. Teams that automate hardening well usually find they have already produced half the evidence their next audit asks for — which is the cheapest compliance work available.

Scan before you harden. The first report is the baseline you will use to show progress, and it is only available once.