auditing-cloud-with-cis-benchmarks

name	auditing-cloud-with-cis-benchmarks
description	Use when this skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting CIS Foundations Benchmark controls, running automated assessments with tools like Prowler and ScoutSuite, remediating failed controls, and maintaining continuous compliance monitoring against CIS v5 for AWS, v4 for Azure, and v4 for GCP.
domain	cybersecurity
tags	["cis-benchmarks","cloud-audit","compliance-assessment","prowler","security-hardening"]
subdomain	cloud-security
version	1.0.0
author	oyi77
license	Apache-2.0
nist_ai_rmf	["GOVERN-1.1","GOVERN-4.2","MAP-2.3"]
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]

Auditing Cloud With Cis Benchmarks

Overview

Cybersecurity skill for auditing cloud with cis benchmarks. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "auditing cloud with cis benchmarks"

• "This skill details how to conduct cloud security audits using Center for Interne"

• When performing initial security audits of cloud environments against industry-standard benchmarks

• When preparing for SOC 2, ISO 27001, or regulatory audits that reference CIS controls

• When establishing a measurable security baseline for new cloud accounts or subscriptions

• When tracking compliance improvement over time with periodic reassessment

• When evaluating the security posture of acquired or inherited cloud environments

Do not use for runtime threat detection (see detecting-cloud-threats-with-guardduty), for application-level security testing (see conducting-cloud-penetration-testing), or for compliance frameworks not based on CIS (refer to specific regulatory skill files).

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Read-only access to target cloud accounts (AWS SecurityAudit policy, Azure Reader role, GCP Viewer role)
• Prowler, ScoutSuite, or cloud-native CSPM tools installed and configured
• Understanding of CIS benchmark structure: sections, controls, profiles (Level 1 and Level 2)
• Remediation access for implementing fixes (separate from audit credentials)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: ) -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}