Attribution & licensing

License

Pavois is released under the Apache License 2.0. It is the executable Linux profile of the open SOCLE norm.

Where the controls come from

The control base was seeded once from ComplianceAsCode / SCAP Security Guide (BSD-3-Clause) and cross-validated against ansible-lockdown (MIT) and the official SSG datastreams. It is now Pavois-owned and maintained directly. Pavois maps only the reference numbers of each standard (facts); it does not reproduce the prose of the CIS, PCI-DSS or other benchmark documents.

Engine

Pavois runs on CINC Auditor, the free, trademark-free build of Chef InSpec.

Trademarks

CIS Benchmarks, PCI DSS, DISA STIG and NIST are trademarks of their respective owners. Pavois is not affiliated with, endorsed by, or certified by any of them. NIST and STIG content is U.S. Government public domain. ANSSI-BP-028 is published by the French ANSSI.

Build-time tooling

The offline mapping-validation tooling queries intuitem/ciso-assistant (AGPL-3.0) at build time only, it is never embedded in the binary or the site.

Honesty note

Most Pavois controls map to several standards at once, but single-standard and source-only controls exist and stay visible. Pavois does not claim that every rule is cross-validated against multiple authorities.