Hardening 200 servers with Ansible + CIS Benchmarks
A repeatable compliance pipeline: OpenSCAP reports in CI, drift detection nightly, zero critical findings at audit.
Compliance audits go much better when the evidence generates itself.
CIS Level 1 first
Start with Level 1 server benchmarks — safe for most workloads — then specialize per role.
Continuous evidence
OpenSCAP runs nightly; findings land in a dashboard the auditors can read directly.
Drift detection
A nightly playbook diffs running config against Git and opens a PR when they disagree.