CIS Benchmarks

Consensus-built, prescriptive configuration baselines for hardening operating systems and software. Each recommendation carries a number, a level (1 = base, 2 = defence-in-depth), an audit and a remediation. Pavois maps to the per-OS benchmark version it targets.

Authority Center for Internet SecurityVersion per OS, see the benchmark tablecoverage 473 controlsOfficial documentation →Evidence & exports ID model OSCAL ↓

10 high409 medium43 low9 OS95% reboot-proof

The benchmark version targeted, per OS

A CIS number means nothing without its version: the benchmark renumbers between releases. Here is the version each Pavois profile targets, and its source. Three OSes have NO published CIS benchmark: their numbers are inherited from a sibling OS, and this page says so rather than hiding it.

OS	CIS version targeted	Source
`Debian 12`	1.1.0	ansible-lockdown/DEBIAN12-CIS
`Debian 13`	1.0.0	ansible-lockdown/DEBIAN13-CIS
`Fedora`	inherited from RHEL 9	no CIS benchmark exists for Fedora; the mappings are inherited from the RHEL family
`RHEL 10`	inherited from RHEL 9	no dedicated RHEL 10 CIS benchmark yet; the mappings are inherited from RHEL9-CIS
`RHEL 8`	4.0.0	ansible-lockdown/RHEL8-CIS
`RHEL 9`	2.0.0	ansible-lockdown/RHEL9-CIS
`Ubuntu 22.04`	3.0.0	ansible-lockdown/UBUNTU22-CIS
`Ubuntu 24.04`	1.0.0	ansible-lockdown/UBUNTU24-CIS
`Ubuntu 26.04`	inherited from Ubuntu 24.04	no CIS benchmark exists for Ubuntu 26.04 yet; the mappings are inherited from UBUNTU24-CIS

CIS Debian 12 v2.0.0 landed in June 2026 (large additions, removals and renumberings). The re-anchoring is in progress; the mappings published here still target 1.1.0, and will say so for as long as that is true. How a mapping is validated →

How to read the references

CIS Benchmark references are hierarchical section numbers that follow the benchmark's table of contents for that OS, 5.1.20 means section 5 › 1 › recommendation 20.

Each recommendation also carries a Level:

Level 1, baseline hardening, broadly safe with minimal operational impact.
Level 2, defence-in-depth for high-security environments; may reduce functionality or performance.

Numbering and sections differ from one OS to the next, because each operating system has its own independently-versioned benchmark, Pavois targets a specific version per OS (the per-OS table above). Three OSes (Fedora, Ubuntu 26.04, RHEL 10) have no published CIS benchmark yet; their numbers are inherited from a sibling OS, marked as such in that table.

Severity

473 / 473

Ref	Rule	OS	Domain	Sev.	CIS ref
SOCLE-CLD-IAM-001	Verify Only Root Has UID 0	9	Accounts	critical	5.4.2.1 · 8.2.1
SOCLE-CLD-IAM-002	Verify All Account Password Hashes are Shadowed	9	Accounts	critical	7.2.1 · 8.3.2
SOCLE-CLD-IAM-003	Verify Root Has A Primary GID 0	9	Accounts	high	5.4.2.2 · 8.2.1
SOCLE-CLD-IAM-004	Set Account Expiration Following Inactivity	8	Accounts (login.defs)	medium	5.4.1.5
SOCLE-CLD-IAM-005	All GIDs referenced in /etc/passwd must be defined in /etc/group	9	Accounts	low	7.2.3 · 8.2.2
SOCLE-CLD-IAM-006	Prevent Login to Accounts With Empty Password	9	Accounts	critical	8.3.1 · 5.3.3.4.1 · 7.2.2
SOCLE-CLD-IAM-007	Ensure all users last password change date is in the past	8	Accounts	medium	5.4.1.6
SOCLE-RUN-AUD-001	Record Events that Modify the System's Discretionary Access Controls - chmod	9	Audit (auditd)	medium	10.3.4 · 6.2.3.9 · 6.3.3.18 · 6.3.3.9
SOCLE-RUN-AUD-004	Record Any Attempts to Run chacl	9	Audit (auditd)	medium	6.2.3.17 · 6.3.3.17 · 6.3.3.15 · 6.3.3.16 · 6.3.3.18 · 6.3.3.26 · 6.3.3.24 · 6.3.3.25 · 6.3.3.10 · 6.3.3.28 · 6.3.3.27 · 6.3.3.6 · 6.3.3.19 · 6.6.3.18
SOCLE-RUN-AUD-005	Ensure auditd Collects File Deletion Events by User - rename	9	Audit (auditd)	medium	10.2.1.7 · 6.2.3.13 · 6.3.3.22 · 6.3.3.13
SOCLE-RUN-AUD-006	Make the auditd Configuration Immutable	9	Audit (auditd)	medium	10.3.2 · 6.2.3.20 · 6.3.3.33 · 6.3.3.20 · 6.3.3.21
SOCLE-RUN-AUD-007	Ensure auditd Collects Information on Kernel Module Unloading - create_module	4	Audit (auditd)	medium	6.3.3.29 · 6.3.3.30 · 6.3.3.31 · 6.3.3.19
SOCLE-RUN-AUD-008	Record Attempts to Alter Logon and Logout Events - faillock	9	Audit (auditd)	medium	10.2.1.3 · 6.2.3.12 · 6.3.3.21 · 6.3.3.12
SOCLE-RUN-AUD-009	Record Events that Modify the System's Mandatory Access Controls	9	Audit (auditd)	medium	10.3.4 · 6.3.3.14 · 6.3.3.23 · 6.2.3.14
SOCLE-RUN-AUD-010	Ensure auditd Collects Information on Exporting to Media (successful)	9	Audit (auditd)	medium	10.2.1.7 · 6.2.3.10 · 6.3.3.19 · 6.3.3.10
SOCLE-RUN-AUD-011	Record Events that Modify the System's Network Environment	9	Audit (auditd)	medium	10.3.4 · 6.2.3.5 · 6.3.3.5 · 6.3.3.7 · 6.3.3.6 · 6.3.3.8 · 6.3.3.9
SOCLE-RUN-AUD-012	Record Events that Modify the System's Network Environment - /etc/sysconfig/network-scripts	4	Audit (auditd)	medium	6.3.3.5
SOCLE-RUN-AUD-013	Ensure auditd Collects Information on the Use of Privileged Commands - fdisk	3	Audit (auditd)	medium	6.3.3.19 · 6.2.3.19
SOCLE-RUN-AUD-015	Record Attempts to Alter Process and Session Initiation Information	9	Audit (auditd)	medium	6.2.3.11 · 6.3.3.20 · 6.3.3.11
SOCLE-RUN-AUD-017	Record Events When Executables Are Run As Another User	9	Audit (auditd)	medium	6.2.3.2 · 6.3.3.2
SOCLE-RUN-AUD-018	Record Events When Privileged Executables Are Run	7	Audit (auditd)	medium	10.2.1.2
SOCLE-RUN-AUD-019	Ensure auditd Collects System Administrator Actions	8	Audit (auditd)	medium	10.2.1.5 · 6.2.3.1 · 6.3.3.1
SOCLE-RUN-AUD-020	Record attempts to alter time through adjtimex	9	Audit (auditd)	medium	10.6.3 · 6.2.3.4 · 6.3.3.4
SOCLE-RUN-AUD-021	Record Attempts to Alter Time Through clock_settime	9	Audit (auditd)	medium	10.6.3 · 6.2.3.4 · 6.3.3.4
SOCLE-RUN-AUD-022	Record Unsuccessful Access Attempts to Files - creat	9	Audit (auditd)	medium	6.2.3.7 · 6.3.3.11 · 6.3.3.7
SOCLE-RUN-AUD-023	Record Events that Modify User/Group Information - /etc/group	9	Audit (auditd)	medium	10.2.1.5 · 6.2.3.8 · 6.3.3.8 · 6.3.3.12 · 6.3.3.14 · 6.3.3.16 · 6.3.3.15 · 6.3.3.17 · 6.3.3.13
SOCLE-RUN-AUD-025	Configure auditd mail_acct Action on Low Disk Space	9	Audit (auditd daemon)	medium	6.2.2.4 · 6.3.2.4
SOCLE-RUN-AUD-026	Configure auditd admin_space_left Action on Low Disk Space	9	Audit (auditd daemon)	medium	10.5.1 · 6.2.2.4 · 6.3.2.4
SOCLE-RUN-AUD-028	Configure auditd Disk Error Action on Disk Error	9	Audit (auditd daemon)	medium	6.2.2.3 · 6.3.2.3
SOCLE-RUN-AUD-029	Configure auditd Disk Full Action when Disk Space Is Full	9	Audit (auditd daemon)	medium	6.2.2.3 · 6.3.2.3
SOCLE-RUN-AUD-032	Configure auditd Max Log File Size	9	Audit (auditd daemon)	medium	6.2.2.1 · 6.3.2.1
SOCLE-RUN-AUD-033	Configure auditd max_log_file_action Upon Reaching Maximum Log Size	9	Audit (auditd daemon)	medium	6.2.2.2 · 6.3.2.2
SOCLE-RUN-AUD-036	Configure auditd space_left Action on Low Disk Space	9	Audit (auditd daemon)	medium	10.5.1 · 6.2.2.4 · 6.3.2.4
SOCLE-CLD-GEN-001	Ensure Local Login Warning Banner Is Configured Properly	9	Banners	medium	1.6.2 · 1.7.2
SOCLE-CLD-GEN-002	Ensure Remote Login Warning Banner Is Configured Properly	9	Banners	medium	1.6.3 · 1.7.3
SOCLE-CLD-GEN-003	Ensure Message Of The Day Is Configured Properly	9	Banners	medium	1.6.1 · 1.7.1
SOCLE-CLD-KRN-001	Enable Auditing for Processes Which Start Prior to the Audit Daemon	9	Kernel command line	low	10.7.2 · 6.2.1.3 · 6.3.1.2 · 6.3.1.3
SOCLE-CLD-KRN-002	Extend Audit Backlog Limit for the Audit Daemon	9	Kernel command line	low	10.7.2 · 6.2.1.4 · 6.3.1.3
SOCLE-CLD-KRN-013	Ensure SELinux Not Disabled in /etc/default/grub	4	Kernel command line	medium	1.3.1.2
SOCLE-CLD-GEN-004	Enable GNOME3 Login Warning Banner	9	GNOME desktop (dconf)	medium	1.7.2 · 1.8.2 · 1.8.1
SOCLE-CLD-GEN-005	Disable GNOME3 Automounting	9	GNOME desktop (dconf)	medium	1.7.6 · 1.7.7 · 3.4.2 · 1.8.6 · 1.8.4
SOCLE-CLD-GEN-006	Disable GNOME3 Automount Opening	9	GNOME desktop (dconf)	medium	1.7.6 · 1.7.7 · 3.4.2 · 1.8.6 · 1.8.4
SOCLE-CLD-GEN-007	Disable GNOME3 Automount running	9	GNOME desktop (dconf)	low	1.7.8 · 1.7.9 · 1.8.8 · 1.8.5
SOCLE-CLD-GEN-010	Disable the GNOME3 Login User List	9	GNOME desktop (dconf)	medium	1.7.3 · 1.8.3 · 1.8.2
SOCLE-CLD-GEN-012	Set the GNOME3 Login Warning Banner Text	9	GNOME desktop (dconf)	medium	1.7.2 · 1.8.2 · 1.8.1
SOCLE-CLD-GEN-016	Set GNOME3 Screensaver Lock Delay After Activation Period	3	GNOME desktop (dconf)	medium	1.7.4 · 1.8.5 · 1.7.5 · 8.2.8
SOCLE-CLD-GEN-018	Set GNOME3 Screensaver Inactivity Timeout	3	GNOME desktop (dconf)	medium	1.7.4 · 1.8.5 · 1.7.5 · 8.2.8
SOCLE-CLD-GEN-019	Enable GNOME3 Screensaver Lock After Idle Period	9	GNOME desktop (dconf)	medium	1.7.4 · 1.7.5 · 8.2.8
SOCLE-CLD-GEN-021	Implement Blank Screensaver	5	GNOME desktop (dconf)	medium	8.2.8
SOCLE-CLD-GEN-023	Ensure Users Cannot Change GNOME3 Screensaver Settings	8	GNOME desktop (dconf)	medium	1.8.5 · 1.8.3
SOCLE-CLD-GEN-024	Ensure Users Cannot Change GNOME3 Session Idle Settings	8	GNOME desktop (dconf)	medium	1.8.5 · 1.8.3
SOCLE-CLD-IAM-008	Lock Accounts After Failed Password Attempts	9	Accounts (faillock)	medium	5.3.3.1.1 · 8.3.4
SOCLE-CLD-IAM-009	Set Lockout Time for Failed Password Attempts	9	Accounts (faillock)	medium	5.3.3.1.2 · 8.3.4
SOCLE-CLD-GEN-025	Ensure that /etc/at.allow exists	9	Cron/at access control	medium	2.4.2.1
SOCLE-CLD-GEN-026	Ensure that /etc/at.deny does not exist	9	Cron/at access control	medium	2.4.2.1
SOCLE-CLD-GEN-027	Ensure that /etc/cron.allow exists	9	Cron/at access control	medium	2.4.1.2 · 2.4.1.8 · 2.4.1.9
SOCLE-CLD-GEN-028	Ensure that /etc/cron.deny does not exist	9	Cron/at access control	medium	2.2.6 · 2.4.1.8 · 2.4.1.9
SOCLE-CLD-FSP-001	Verify Group Who Owns /etc/at.allow file	9	File ownership	medium	2.2.6 · 2.4.2.1
SOCLE-CLD-FSP-002	Verify Group Who Owns /etc/at.deny file	9	File ownership	medium	2.4.2.1
SOCLE-CLD-FSP-003	Verify Group Who Owns Backup group File	9	File ownership	medium	2.2.6 · 7.1.4