How do I implement CIS benchmarks?

More context

The reason to begin with assessment rather than remediation is that hardening blind is risky. Applying a full benchmark to systems without first knowing which settings are already met, and which would break an application, tends to cause outages that give hardening a bad reputation internally. A gap scan first turns an abstract benchmark into a concrete, prioritized list scoped to the environment you actually run.

Sequencing the remediation matters just as much. Level 1 settings are chosen to be broadly safe, so rolling them out across production first captures most of the risk reduction with the least operational disruption, while Level 2 is applied selectively to systems handling sensitive data after testing. The final step, scheduled scanning, is what keeps the effort from decaying, because configurations drift and a one-time hardening project quietly erodes without ongoing checks.