cis
1 post · all writing
CIS benchmarks are somebody else's checklist, and that is the point
A benchmark will flag things you have deliberately chosen, and treating every failed check as a defect is how teams end up ignoring the whole report. The value is not the score. It is the short list of checks you decided not to meet, and the record of who decided.