Free working template · Version 1.0
Turn scan results into an evidence plan.
A practical evidence-readiness pack for teams preparing a CIS benchmark assessment. Define scope, assign owners and identify missing records before meeting your reviewer.
Plain-text template. Opens in any text editor. No email required; no customer data or generated assessment results are included.
1. Establish scope
- Record assets, owners, environment and excluded systems.
- Choose the exact benchmark version and profile.
- Agree assessment permissions and change windows.
- Define the review period and evidence retention rules.
2. Assemble the evidence register
- Link each result to an asset and control identifier.
- Record collection time, method and source location.
- Separate automated checks from manual review.
- Record evidence integrity checks and reviewer decisions.
3. Make exceptions reviewable
- Document the business reason and compensating controls.
- Assign a risk owner and approving authority.
- Set expiry and review dates.
- Link remediation tickets and re-test results.
4. Prepare the reviewer handover
- Summarise coverage and known gaps.
- Distinguish configuration evidence from policy evidence.
- Agree sampling and acceptance criteria with the reviewer.
- Track decisions without changing the original evidence.
What this pack helps you decide
Can a reviewer trace a finding to its asset, benchmark version, collection method, owner and current disposition? If any link is missing, record the gap and assign the next action.
This is an original CISGuard planning template, not an official CIS assessment, certification checklist or promise of regulatory compliance. It contains no CIS benchmark control text. Use the applicable published standard and your reviewer’s requirements.
Official CIS Benchmarks · CISGuard product scope · Build an illustrative business case