CIS Benchmark & Remediation Program

Measured posture improvement across a DevOps platform

A scan, remediate, and re-measure cycle against CIS Benchmark controls for a DevOps platform — taking the applicable-control pass rate from 39.6% to 54.2% across three measured scans, with every change applied programmatically.

CIS BenchmarksComplianceGitLab APIBranch ProtectionPythonReporting

## Problem

Compliance work usually ends at the report. Findings get filed, a few are fixed by hand, and nobody re-scans — so the organisation never learns whether the effort moved the number, and the next audit starts from the same place.

## Method

122 controls were scanned, of which 48 were applicable to the environment. Remediation was applied through the platform's API rather than its console — branch protection restricting push and merge to maintainers, force-push denied, branch deletion denied, restrictions on who may dismiss code review, and merge gates requiring resolved discussions and passing pipelines. The suite was then re-run to measure the delta rather than assert one.

## Measured result

Pass rate across applicable controls moved 39.6% → 52.1% → 54.2% over three scans — 19 controls passing at baseline, 26 at the end. Reporting distinguishes critical findings from advisory ones and pairs each with the specific control it satisfies.

## On the denominator

61% of the benchmark's controls were skipped — not applicable at the scanned scope, requiring permissions the scanner did not hold, or needing manual validation. The reported figures use applicable controls as the denominator, not the full 122. Quoting the larger number would roughly double the apparent achievement and would not survive an auditor asking which controls were actually evaluated.

## Lessons Learned

Applying fixes through the API rather than the UI is what made the second and third scans meaningful — the changes were reproducible, reviewable, and could be re-applied to another project without anyone remembering which checkboxes were ticked. The remaining failures are mostly the ones that need organisational agreement rather than a setting change, which is the usual shape of the last stretch of a compliance push.

// ls ../

FLAGSHIP

CIS Benchmark & Remediation Program

## Problem

## Method

## Measured result

## On the denominator

## Lessons Learned

Snock →

SpecterHeal →

Enterprise DDoS Defense →

Hardened GitLab DevSecOps Platform →

Trend Micro XDR Remediation →

AWS Incident Response Automation →

SOC Automation & Visualization →

Fortinet SD-WAN Deployment →

CTF Training Platform →

Cloud Monitoring & Observability Platform →

Open Banking Auth Flow Load Testing →