CIS Level 1 at 74%: Exceptions, Compensating Controls, and a Number for the Board
A hardening review covers 180 RHEL 8 servers and 60 Windows Server 2019 members against CIS Level 1. The automated scanner reports 74% overall pass. Three clusters dominate the failures. (a) Twenty-two TLS 1.0/1.1 enabled findings sit on six hosts running a vendor appliance console whose current release supports only TLS 1.0; the vendor's end-of-support date is 11 months away and no TLS 1.2 release date is committed. (b) Forty password minimum-length findings affect service accounts that use 25-character randomly generated secrets rotated every 90 days and cannot log on interactively. (c) Eighteen findings arise because the scanner read a local configuration file before a later-applied GPO refreshed it. The CISO wants one compliance percentage for the audit committee. A change freeze is in effect for 30 days.
1. What should you report instead of the raw 74%, and how do you build that number?
Read the worked answer
A single percentage is only meaningful if its denominator and treatment rules are stated. Build it in layers and show the layers.
- Validate the raw results first. Re-check the 18 order-of-application findings by re-scanning after the GPO refresh or by reading the effective policy. If they are stale reads, they are scan defects, not control failures, and should be removed from the numerator/denominator before scoring - with the correction documented.
- Classify every remaining finding into: confirmed non-compliant and fixable; confirmed non-compliant with an approved exception/compensating control; accepted risk with owner sign-off; false positive with evidence.
- Report at least three numbers: technical pass rate on validated results, pass rate excluding formally accepted exceptions (each listed), and the count of open items with no compensating control. The third number is the one that matters to the audit committee.
- Do not blend (b) into 'pass'. The service accounts do not meet the literal control; calling them compliant hides a decision that should be recorded as a compensating control with a named owner.
- State the direction of travel and dates, especially where the 30-day change freeze blocks remediation.
A defensible sentence is: 'Of 240 hosts, X are compliant on validated results, Y have approved compensating controls, Z remain non-compliant with no compensating control.' That is more useful than 74%.
2. How do you handle the TLS 1.0 exception on the six appliance-console hosts?
Read the worked answer
This is a textbook candidate for a time-bound exception, but only if it is evidenced, owned, and constrained.
Establish the facts: what exactly is exposed on those interfaces, from which network segments, with what authentication, and whether the traffic ever crosses an untrusted network. If the console is reachable only from a two-host management VLAN with MFA and no internet path, the practical exposure is very different from a console exposed to the corporate LAN.
Compensating controls to document: management-VLAN segmentation with deny-by-default ACLs, jump-host-only access with MFA and session recording, IDS signatures for known TLS 1.0 attacks, restrictive certificate pinning where supported, enhanced logging and alerting on console authentication, and a shortened credential rotation cycle.
Formalize: an exception record with a named risk owner (not the inspection team), the business justification tied to the vendor support timeline, the residual risk statement, the review date, and the exit condition - either the vendor's TLS 1.2 release or replacement before the 11-month end-of-support date.
Do not let the freeze become the justification. The 30-day change freeze explains why remediation has not started; it does not justify the exception. The exception exists because of vendor capability and business dependency.
Report it as non-compliant with an approved compensating control, not as compliant. If no owner will sign, it stays as an open high finding.
3. How should the service-account password findings and the GPO-order findings each be treated?
Read the worked answer
They look similar in a findings list and are treated completely differently.
Service accounts (40 findings, 25-character random secrets, 90-day rotation, no interactive logon):
- This is not a false positive. The control's literal requirement is not met.
- It is a strong candidate for a compensating control / documented exception, because the control's intent - resist brute force and credential theft - is met or exceeded by 25 random characters, and the non-interactive restriction removes the main attack path.
- Evidence required: secret length and entropy method, rotation automation, the logon-rights configuration, and monitoring for failed authentication.
- Residual risk to state: secrets may sit in scripts or configuration management, and 90-day rotation can create operational pressure to store them insecurely.
GPO-order findings (18):
- Likely scan defects, not control failures. The scanner read a file that was subsequently overwritten by policy refresh.
- Verify by reading effective configuration after refresh, or by re-running the check in a maintenance window.
- If confirmed, remove from the score, document the scanner limitation, and recommend the scanning tool be configured to trigger a policy refresh or to read effective policy rather than cached files.
- Do not silently drop them; the correction itself is an audit trail item and a process finding about assessment quality.