CIS Benchmarks Profile

The Center for Internet Security (CIS) Benchmarks are consensus-based configuration guidelines for hardening operating systems. On RLC Pro Hardened, the CIS Level 2 (Server) profile (cis) is validated and production-ready.

The CIS profiles are delivered as part of the hardened SCAP data stream, not as a separate image. See Profiles for how compliance frameworks are delivered and for the full profile list.

Available CIS profiles

The CIS Benchmarks define Level 1 (practical hardening with limited operational impact) and Level 2 (stricter defense-in-depth), each in Server and Workstation variants.

Profile	Profile ID	Ansible playbook	Status
CIS Level 2 (Server)	`xccdf_org.ssgproject.content_profile_cis`	`rlch9-playbook-cis.yml`	Validated
CIS Level 1 (Server)	`xccdf_org.ssgproject.content_profile_cis_server_l1`	`rlch9-playbook-cis_server_l1.yml`	In development
CIS Level 1 (Workstation)	`xccdf_org.ssgproject.content_profile_cis_workstation_l1`	`rlch9-playbook-cis_workstation_l1.yml`	In development
CIS Level 2 (Workstation)	`xccdf_org.ssgproject.content_profile_cis_workstation_l2`	`rlch9-playbook-cis_workstation_l2.yml`	In development

Warning

Only CIS Level 2 (Server) (cis) is currently validated against the RLC Pro Hardened baseline. The Level 1 and Workstation profile IDs are present in the content but have not yet been validated for RLC Pro Hardened; confirm with CIQ Support before relying on them. The steps below use the validated cis profile.

Ansible playbooks are installed under /usr/share/scap-security-guide/ansible/. The data stream is at /usr/share/xml/scap/ssg/content/ssg-rlch9-ds.xml.

Warning

The RLC Pro Hardened baseline is hardened but is not fully CIS-remediated out of the box. Apply the profile with a remediation step, then re-scan to confirm compliance.

Prerequisites

The scanner and content are preinstalled on RLC Pro Hardened. If they are missing:


sudo dnf install -y openscap-scanner ciq-scap-security-guide

Scan for compliance

The examples below use CIS Level 2 (Server) (cis), the validated profile.


sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis \
  --results /tmp/cis-results.xml \
  --report /tmp/cis-report.html \
  /usr/share/xml/scap/ssg/content/ssg-rlch9-ds.xml

Open /tmp/cis-report.html to review each rule.

Note

oscap returns exit code 0 when every rule passes and exit code 2 when one or more rules fail. A 2 from a scan is expected for a system that has not yet been remediated and does not indicate a tool error.

Apply CIS remediation

Test in a non-production environment first. Choose one approach.

Option 1: OpenSCAP online remediation


sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis \
  --remediate \
  --results /tmp/cis-results.xml \
  --report /tmp/cis-report.html \
  /usr/share/xml/scap/ssg/content/ssg-rlch9-ds.xml

Option 2: Ansible playbook

Ansible is preinstalled on the standard hardened image; on a minimal install, add it first with sudo dnf install -y ansible-core.


sudo ansible-playbook -i "localhost," -c local \
  /usr/share/scap-security-guide/ansible/rlch9-playbook-cis.yml

Option 3: Generate a remediation script


sudo oscap xccdf generate fix \
  --profile xccdf_org.ssgproject.content_profile_cis \
  --fix-type bash \
  /usr/share/xml/scap/ssg/content/ssg-rlch9-ds.xml > cis-remediate.sh

After remediation, reboot if kernel or boot parameters changed, then re-run the scan to confirm the failing rules now pass.

FIPS mode and CIS

If your environment requires both CIS hardening and FIPS 140-3 validated cryptography, enable FIPS mode in addition to applying the CIS profile. See Enabling FIPS Mode.

Verify

Re-run the scan (above) and confirm the target rules report pass in the HTML report.
Check FIPS, crypto policy, and SELinux status with the compliance check script.

Overview DISA STIG Profile