What CIS Versions are used? #181
-
|
Looking at the baselines, there is no indication of which version of each CIS OS baseline is being used. For example, for 10.15 Catalina: CIS has v2.0.0 and 2.1.0 available, Big Sur has the same, Monterey has v1.0.0 and v1.1.0. Are the baselines in the project updated to the most recent CIS baselines? Also, in the Catalina branch, only cisv8 is available but in Big Sur, Monterey, and Ventura cis_lvl1, cis_lvl2, and cisv8 are available. Are the lvl1 and lvl2 baselines older v7 CIS controls? |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 9 replies
-
|
The benchmark version is in the baseline yaml file. It was decided that we would not include the Catalina benchmark in the project when we included the benchmarks. |
Beta Was this translation helpful? Give feedback.
-
|
Got it, that all makes sense. I guess what I am hung up on is my understanding of v8 controls is they are generic controls that are applicable to any system. The baselines then take those controls and make them specific to a system, OS, etc. However, if I run the generate guidance script with the cisv8.yaml in Catalina, I still get a very specific list of commands and settings to not only determine compliance but to also run commands that will bring the system up to compliance. So the cisv8.yaml is acting like a baseline as far as I understand. Am I missing something? |
Beta Was this translation helpful? Give feedback.
-
|
Much like 800-53, we've translated CISv8 control to a setting within the macOS. The CIS v8 controls are generic controls. Your organization can interpret them however you'd like. We've interpreted the control to setting mapping with what we think they equal as well as general best practices when it comes to values for settings. cisv8.yaml is a baseline. You are able to customize it to your hearts content. |
Beta Was this translation helpful? Give feedback.
-
|
Got it, so the cisv8.yaml is mSCP's (and NIST's after SP800-219?) interpretation of CISv8 controls for macOS [insert version here] while the cis_lvl1.yaml and the cis_lvl2.yaml are CIS's official baseline guidance based on how much hardening you want to do. Am I on the right track now? |
Beta Was this translation helpful? Give feedback.
-
|
Correct. The only change in what you've said cis_lvl1 and lvl2 are benchmarks. Small change but makes a difference in the meaning. Benchmarks are defined set of settings and values. |
Beta Was this translation helpful? Give feedback.
-
|
Appreciate you sticking with me. Thanks! |
Beta Was this translation helpful? Give feedback.
The benchmark version is in the baseline yaml file.
It was decided that we would not include the Catalina benchmark in the project when we included the benchmarks.