Skill: vahagn-madatyan/cis-benchmark-audit (version 1.0.0)

--- name: cis-benchmark-audit description: >- CIS benchmark compliance assessment for network infrastructure devices. Maps device configuration against CIS benchmark controls organized by Management Plane, Control Plane, and Data Plane categories across Cisco IOS, PAN-OS, JunOS, and Check Point platforms. References control IDs for traceability without reproducing copyrighted benchmark content. license: Apache-2.0 metadata: safety: read-only author: network-security-skills-suite version: "1.0.0" openclaw: '{"emoji":"📋","safetyTier":"read-only","requires":{"bins":["ssh"],"env":[]},"tags":["cis","compliance","benchmark"],"mcpDependencies":[],"egressEndpoints":[]}' --- # CIS Benchmark Compliance Audit Compliance assessment skill that maps network device configuration against CIS benchmark controls. Organizes audit checks by Management Plane, Control Plane, and Data Plane — the three architectural layers CIS uses to structure network device benchmarks. Covers the four platforms CIS publishes network device benchmarks for: Cisco IOS, PAN-OS, JunOS, and Check Point. The operator must obtain the applicable CIS benchmark document for their specific platform and version — this skill references CIS control IDs and section categories for traceability but does not reproduce copyrighted benchmark text, remediation steps, or rationale (see D026). Consult `references/control-reference.md` for CIS control ID mappings to audit areas and `references/cli-reference.md` for per-platform read-only verification commands. ## When to Use - Annual or quarterly CIS compliance audit against network infrastructure - Pre-audit preparation — building evidence collection before formal assessment - New device commissioning — establishing CIS compliance baseline on day one - Post-upgrade verification — confirming controls remain in place after OS upgrade - Regulatory compliance evidence — mapping CIS controls to PCI DSS, HIPAA, or SOX technical requirements via CIS crosswalk references - Merger/acquisition due diligence — assessing acquired network infrastructure against organizational CIS compliance posture ## Prerequisites - Read-only CLI or API access to each target device (SSH, console, or management API with read-only administrative role) - The applicable CIS benchmark document for the target platform and OS version — operators must obtain their own licensed copy (e.g., "CIS Cisco IOS 16 Benchmark v1.1.0"). This skill references control IDs only - Understanding of the device's role in the network architecture — the device's position (edge, core, distribution, management) affects which controls apply and their priority - Awareness of any compensating controls already in place that satisfy CIS requirements through alternative mechanisms - Documentation of any accepted risk exceptions for controls intentionally not implemented ## Procedure Follow this six-step compliance assessment flow. Each step builds on prior findings. The procedure maps device configuration to CIS benchmark controls organized by management architecture layer. ### Step 1: Platform Identification and Benchmark Selection Identify the device platform, OS version, and hardware model. Select the matching CIS benchmark by ID and version. **[Cisco]** `show version` — capture IOS/IOS-XE version, hardware model **[PAN-OS]** `show system info` — capture PAN-OS version, platform model **[JunOS]** `show version` — capture Junos OS version, hardware model **[CheckPoint]** `fw ver` and `cpinfo -y all` — capture Gaia OS version, platform Record the exact benchmark ID that matches your platform version (e.g., "CIS Cisco IOS 16 Benchmark v1.1.0", "CIS Palo Alto Firewall 10 Benchmark v1.0.0"). If no benchmark exists for the exact OS version, use the closest available and document the version gap. Determine the CIS profile level to assess against: - **Level 1:** Essential security controls, broadly applicable - **Level 2:** Defense-in-depth controls, may reduce functionality ### Step 2: Management Plane Audit Assess controls that protect device management access and monitoring. This covers CIS sections typically numbered 1.x and 2.x. **Local authentication and authorization:** **[Cisco]** `show running-config | section aaa` — verify AAA is enabled with TACACS+ or RADIUS, check that local fallback accounts use strong hashing (`algorithm-type scrypt` or `secret 9`). **[PAN-OS]** `show config running | match authentication` — verify authentication profile binds to RADIUS/LDAP/SAML, check password complexity profile exists. **[JunOS]** `show configuration system authentication-order` — verify TACACS+/RADIUS is primary with local fallback, check `show configuration system login` for account policies. **[CheckPoint]** `show configuration aaa` — verify RADIUS/TACACS+ integration, check administrator account password policies. **SSH and management transport:** Verify SSH v2 only (no SSHv1 or Telnet), session timeout configured, management access restricted to specific source addresses or management VLAN. Check certificate-based authentication where supported. **Logging and monitoring:** Verify syslog is configured to a remote server with appropriate severity levels (informational minimum for security events), SNMP v3 with authentication and encryption (no v1/v2c with community strings), and NTP authentication to trusted time sources. **Login banners:** Confirm legal notice/warning banners are configured on all management access methods (console, VTY, web UI). ### Step 3: Control Plane Audit Assess controls that protect routing and signaling protocols. CIS sections typically numbered 3.x. **Routing protocol authentication:** Verify OSPF, BGP, and IS-IS neighbor authentication is enabled. **[Cisco]** `show ip ospf interface` — check for authentication type (MD5 or SHA-256). `show ip bgp neighbors` — verify password is set per neighbor. **[PAN-OS]** `show routing protocol ospf area` — verify area authentication. `show routing protocol bgp peer` — check MD5 authentication. **[JunOS]** `show ospf interface detail` — verify authentication-type. `show bgp neighbor` — check authentication-key presence. **[CheckPoint]** Routing configured via Gaia Clish: `show route ospf` with `show configuration ospf` for authentication settings. **Control Plane Protection:** Verify rate limiting on management-bound traffic to prevent CPU exhaustion from packet floods targeting the control plane processor. **[Cisco]** `show policy-map control-plane` — verify CoPP (Control Plane Policing) is applied with appropriate rate limits. **[JunOS]** `show firewall filter` — verify loopback/lo0 filter protects the routing engine with rate-limit policers. **ARP and DHCP protection:** Verify Dynamic ARP Inspection (DAI) and DHCP snooping on access-layer switches to prevent ARP spoofing and rogue DHCP attacks. ### Step 4: Data Plane Audit Assess controls that protect traffic forwarding. CIS sections typically numbered 4.x and 5.x. **Access control lists:** Verify explicit deny rules with logging at ACL boundaries. Check that infrastructure ACLs protect device management addresses from data plane traffic. **Unicast Reverse Path Forwarding (uRPF):** **[Cisco]** `show ip interface` — check for `ip verify unicast source reachable-via` on external-facing interfaces. **[JunOS]** `show configuration interfaces` — check for `family inet rpf-check` on upstream interfaces. Anti-spoofing via uRPF validates source addresses against the routing table, dropping packets with forged source IPs. **Storm control and port security:** Verify broadcast/multicast/unicast storm control thresholds on access ports. Check 802.1X or MAC-based authentication on edge ports where applicable. **Encryption:** Verify management traffic encryption (SSH, HTTPS, SNMPv3). Assess MACsec for LAN encryption and IPsec for WAN links where required by organizational policy or CIS Level 2 controls. ### Step 5: Compliance Scoring and Gap Analysis Tally results per CIS section and per architectural plane. For each control tested, record: - **Pass:** Device configuration satisfies the control requirement - **Fail:** Device configuration does not meet the control requirement - **Not Applicable:** Control does not apply to this device role or deployment model (document justification) Calculate compliance percentage per plane: `Compliance % = (Pass / (Pass + Fail)) × 100` (exclude N/A from denominator) Identify critical gaps — any Level 1 control failure in the Management Plane is a priority finding because it affects the security of all other controls (if management access is compromised, all other controls are bypassable). ### Step 6: Priority-Ranked Remediation Plan Order findings for remediation based on CIS control level and operational impact. **Priority 1 — Level 1 Management Plane failures:** AAA bypass, cleartext management protocols, missing logging. These undermine all other controls. **Priority 2 — Level 1 Control/Data Plane failures:** Unauthenticated routing protocols, missing ACLs, disabled uRPF. These allow traffic manipulation or spoofing. **Priority 3 — Level 2 Management Plane items:** Enhanced encryption, additional monitoring, granular access controls. These add defense-in-depth. **Priority 4 — Level 2 Control/Data Plane items:** CoPP fine-tuning, MACsec deployment, advanced storm control thresholds. These optimize existing protections. Group remediation actions by effort: - **Quick wins:** Configuration commands that can be applied in a maintenance window without service impact - **Planned changes:** Items requiring change management, testing, or coordination with other teams - **Projects:** Items requiring infrastructure changes, new hardware, or significant design work ## Threshold Tables ### Compliance Violation Severity | Severity | CIS Level | Condition | Examples | |----------|-----------|-----------|----------| | Critical | Level 1 fail | Management access without AAA or encryption | Telnet enabled, no AAA configuration, SNMP v1/v2c with default community, no remote logging configured | | High | Level 1 fail | Partial control implementation with gaps | NTP configured but without authentication, SSH enabled but v1 not disabled, login banner missing on some access methods | | Medium | Level 2 fail | Defense-in-depth control not implemented | CoPP not configured, uRPF not enabled on external interfaces, storm control disabled on access ports | | Low | Level 2 | Optional hardening not applied | Custom banner text not meeting organizational standard, SNMP informational traps not tuned, optional encryption on internal-only links | ### Compliance Posture Summary | Score Range | Posture | Guidance | |-------------|---------|----------| | 90–100% | Strong | Address remaining gaps in next maintenance cycle | | 70–89% | Moderate | Prioritize Level 1 failures, schedule Level 2 within quarter | | 50–69% | Weak | Immediate remediation plan required, escalate to management | | <50% | Critical | Device may require isolation until baseline controls are applied | ## Decision Trees ### Compliance Remediation Priority ``` CIS control finding: FAIL ├── Is it a Level 1 control? │ ├── Yes │ │ ├── Management Plane control? │ │ │ ├── Yes → PRIORITY 1 (Critical/High) │ │ │ │ ├── Is device internet-facing? │ │ │ │ │ ├── Yes → Immediate remediation required │ │ │ │ │ └── No → Remediate within 7 days │ │ │ │ └── Is there a compensating control? │ │ │ │ ├── Yes → Document compensating control, schedule fix │ │ │ │ └── No → Escalate immediately │ │ │ └── Control/Data Plane control? │ │ │ └── PRIORITY 2 (High) │ │ │ └── Remediate within 30 days │ │ └── No (Level 2 control) │ │ ├── Management Plane? │ │ │ └── PRIORITY 3 (Medium) │ │ │ └── Schedule within quarter │ │ └── Control/Data Plane? │ │ └── PRIORITY 4 (Low/Medium) │ │ └── Schedule within next audit cycle │ └── Control marked Not Applicable? ├── Justified? (deployment model, device role) │ ├── Yes → Document exception with approval │ └── No → Re-evaluate, may be a gap ``` ### Benchmark Version Selection ``` Identify target device OS version ├── Exact CIS benchmark version available? │ ├── Yes → Use exact match │ └── No → Use nearest lower version benchmark │ ├── Gap > 2 major versions? │ │ ├── Yes → Flag reduced coverage, request updated benchmark │ │ └── No → Acceptable, note version delta in report │ └── New OS features not covered by benchmark? │ └── Document as out-of-scope for this assessment ``` ## Report Template ``` CIS BENCHMARK COMPLIANCE ASSESSMENT ====================================== Device: [hostname] Platform: [Cisco IOS / PAN-OS / JunOS / Check Point] OS Version: [version] Device Role: [edge / core / distribution / access] Audit Date: [timestamp] Performed By: [operator/agent] BENCHMARK REFERENCE: - Benchmark ID: [e.g., CIS Cisco IOS 16 Benchmark v1.1.0] - Profile Level Assessed: [Level 1 / Level 1+2] - Note: Operator must obtain licensed copy for full control descriptions COMPLIANCE SCORE BY PLANE: Management Plane: [n] pass / [n] fail / [n] N/A ([%] compliant) Control Plane: [n] pass / [n] fail / [n] N/A ([%] compliant) Data Plane: [n] pass / [n] fail / [n] N/A ([%] compliant) Overall: [n] pass / [n] fail / [n] N/A ([%] compliant) CRITICAL FINDINGS (Level 1 Failures): 1. [CIS Control ID] — [Config area] — [Finding summary] Plane: [Management/Control/Data] Current State: [what was observed] Impact: [operational risk] HIGH FINDINGS (Level 1 Partial / Level 2 Critical): 1. [CIS Control ID] — [Config area] — [Finding summary] REMEDIATION PLAN: Priority 1 (Immediate — Level 1 Management Plane): - [Action] — [CIS Control ID] — [Estimated effort] Priority 2 (30-day — Level 1 Control/Data Plane): - [Action] — [CIS Control ID] — [Estimated effort] Priority 3 (Quarter — Level 2): - [Action] — [CIS Control ID] — [Estimated effort] EXCEPTIONS AND COMPENSATING CONTROLS: - [CIS Control ID] — [Reason for exception] — [Compensating control] NEXT ASSESSMENT: [based on posture — Critical: 30d, Weak: 90d, Moderate: 180d, Strong: 365d] ``` ## Troubleshooting ### Benchmark Version Mismatch CIS benchmarks target specific OS versions. When the device runs a version not covered by any published benchmark, use the nearest available benchmark and document the gap. New features introduced after the benchmark's target version may not have corresponding controls — assess these independently. ### Platform-Specific Configuration Locations The same logical control (e.g., AAA configuration) exists in different configuration hierarchies per platform. Cisco IOS uses `aaa new-model` in global config, PAN-OS uses authentication profiles in device settings, JunOS uses `system authentication-order`, and Check Point uses SmartConsole or Gaia Clish. The `references/cli-reference.md` file provides the correct audit command per platform. ### Controls Not Applicable to All Deployment Models Some CIS controls assume a specific deployment model. For example, DHCP snooping controls apply to access-layer switches but not to core routers or firewalls. 802.1X controls apply to wired access ports but not to WAN interfaces. Document each N/A determination with a clear justification tied to the device's role in the network architecture. ### Multi-Context and Virtual System Considerations PAN-OS virtual systems (vsys), Cisco VDCs/VRFs, and JunOS logical systems create isolated administrative domains within a single physical device. Each virtual context should be assessed independently — controls in one context do not automatically apply to others. Inventory all contexts before beginning the audit with platform-specific enumeration commands. ### Compensating Controls Documentation When a CIS control cannot be implemented exactly as described but an equivalent protection exists, document the compensating control with: what CIS control it addresses, what alternative mechanism is in place, and why it provides equivalent or better protection. Accepted risk exceptions require management sign-off with a review date.

path: references/cli-reference.md
content: # CIS Benchmark Audit CLI Reference — Read-Only Commands

Read-only verification commands organized by CIS benchmark category
(Management Plane, Control Plane, Data Plane) for each supported platform.
All commands are non-modifying — suitable for production audit without
change risk.

## Cisco IOS

### Management Plane

| Function | CLI Command |
|----------|-------------|
| AAA configuration status | `show running-config \| section aaa` |
| Authentication methods for login | `show running-config \| include aaa authentication` |
| Authorization configuration | `show running-config \| include aaa authorization` |
| Accounting configuration | `show running-config \| include aaa accounting` |
| VTY line access settings | `show running-config \| section line vty` |
| Console line settings | `show running-config \| section line con` |
| Auxiliary port status | `show running-config \| section line aux` |
| SSH version and settings | `show ip ssh` |
| SSH active sessions | `show ssh` |
| User accounts and privilege levels | `show running-config \| include username` |
| Enable secret hash type | `show running-config \| include enable` |
| SNMP community strings | `show snmp community` |
| SNMP group and security model | `show snmp group` |
| SNMP v3 users | `show snmp user` |
| Syslog configuration | `show running-config \| include logging` |
| Logging buffer and severity | `show logging` |
| NTP server associations | `show ntp associations` |
| NTP authentication status | `show ntp status` |
| Service timestamps configuration | `show running-config \| include service timestamps` |
| Banner configuration | `show running-config \| include banner` |
| HTTP/HTTPS server status | `show running-config \| include ip http` |

### Control Plane

| Function | CLI Command |
|----------|-------------|
| OSPF interface authentication | `show ip ospf interface` |
| OSPF neighbor status | `show ip ospf neighbor` |
| BGP neighbor summary and auth | `show ip bgp neighbors` |
| IS-IS adjacency status | `show isis neighbors` |
| CoPP policy on control plane | `show policy-map control-plane` |
| ARP inspection status per VLAN | `show ip arp inspection vlan` |
| ARP inspection statistics | `show ip arp inspection statistics` |
| DHCP snooping status | `show ip dhcp snooping` |
| DHCP snooping binding table | `show ip dhcp snooping binding` |
| ICMP redirects setting | `show running-config \| include ip redirects` |
| IP source guard bindings | `show ip source binding` |
| CDP/LLDP neighbor status | `show cdp neighbors` |

### Data Plane

| Function | CLI Command |
|----------|-------------|
| All IP access lists | `show ip access-lists` |
| ACL hit counts | `show access-lists` |
| uRPF status per interface | `show ip interface \| include verify` |
| Storm control settings | `show storm-control broadcast` |
| Port security status | `show port-security` |
| 802.1X authentication status | `show dot1x all summary` |
| Spanning tree status | `show spanning-tree summary` |
| IP CEF status | `show ip cef` |
| Interface error counters | `show interfaces counters errors` |

## PAN-OS

### Management Plane

| Function | CLI Command |
|----------|-------------|
| System version and platform info | `show system info` |
| Management interface access profile | `show running management-profile` |
| Admin session idle timeout | `show config running \| match idle-timeout` |
| Authentication profiles | `show config running \| match authentication-profile` |
| Password complexity settings | `show config running \| match password-complexity` |
| SNMP configuration | `show config running \| match snmp` |
| Syslog forwarding configuration | `show config running \| match syslog` |
| Log forwarding status | `show logging-status` |
| NTP server configuration | `show ntp` |
| Login banner setting | `show config running \| match login-banner` |
| Admin account list | `show admins all` |
| Content update versions | `show system info \| match version` |
| License status | `show system license` |

### Control Plane

| Function | CLI Command |
|----------|-------------|
| OSPF area configuration | `show routing protocol ospf area` |
| OSPF neighbor status | `show routing protocol ospf neighbor` |
| BGP peer configuration | `show routing protocol bgp peer` |
| BGP peer status | `show routing protocol bgp summary` |
| DoS protection policies | `show running dos-policy` |
| Session table summary | `show session info` |
| HA status | `show high-availability all` |
| Panorama connection status | `show panorama-status` |

### Data Plane

| Function | CLI Command |
|----------|-------------|
| Full security policy (effective) | `show running security-policy` |
| Security policy hit counts | `show rule-hit-count vsys vsys1 security rules all` |
| Security Profile Groups | `show running profile-group` |
| Zone configuration and assignments | `show running zone` |
| Zone protection profiles | `show running zone-protection-profile` |
| NAT policy | `show running nat-policy` |
| Decryption policy | `show running ssl-decryption-policy` |
| Active sessions by zone pair | `show session all filter from <zone> to <zone>` |
| Policy match test | `test security-policy-match source <IP> destination <IP> protocol <num> destination-port <port> from <zone> to <zone>` |

## JunOS

### Management Plane

| Function | CLI Command |
|----------|-------------|
| Authentication order | `show configuration system authentication-order` |
| Login user accounts | `show configuration system login` |
| Root authentication settings | `show configuration system root-authentication` |
| SSH service configuration | `show configuration system services ssh` |
| SSH rate limit settings | `show configuration system services ssh rate-limit` |
| Telnet service status | `show configuration system services telnet` |
| RADIUS server configuration | `show configuration system radius-server` |
| TACACS+ server configuration | `show configuration system tacplus-server` |
| Syslog configuration | `show configuration system syslog` |
| SNMPv3 configuration | `show configuration snmp v3` |
| SNMP community settings | `show configuration snmp community` |
| NTP configuration | `show configuration system ntp` |
| NTP association status | `show ntp associations` |
| Login banner/message | `show configuration system login message` |
| Web management status | `show configuration system services web-management` |
| System services summary | `show configuration system services` |

### Control Plane

| Function | CLI Command |
|----------|-------------|
| OSPF interface detail and auth | `show ospf interface detail` |
| OSPF neighbor status | `show ospf neighbor` |
| BGP neighbor authentication | `show bgp neighbor` |
| IS-IS adjacency detail | `show isis adjacency detail` |
| Routing engine firewall filter | `show configuration firewall filter` |
| Loopback filter application | `show configuration interfaces lo0` |
| Policer configuration | `show configuration firewall policer` |
| Routing table summary | `show route summary` |

### Data Plane

| Function | CLI Command |
|----------|-------------|
| Firewall filter families | `show configuration firewall family inet` |
| Firewall filter counters | `show firewall` |
| RPF check configuration | `show configuration interfaces \| match rpf-check` |
| Storm control settings | `show configuration ethernet-switching-options storm-control` |
| 802.1X configuration | `show configuration protocols dot1x` |
| Interface filter assignments | `show interfaces filters` |
| Flow session table | `show security flow session summary` |

## Check Point

### Management Plane

| Function | CLI Command |
|----------|-------------|
| Gaia OS version | `show version all` |
| Firewall version | `fw ver` |
| Platform info | `cpinfo -y all` |
| Web interface SSL port | `show web ssl-port` |
| Allowed management clients | `show allowed-client` |
| Session inactivity timeout | `show inactivity-timeout` |
| AAA configuration | `show configuration aaa` |
| Password policy controls | `show password-controls` |
| SNMP agent version | `show snmp agent-version` |
| SNMP configuration | `show snmp` |
| Syslog/log forwarding | `show logging` |
| NTP servers configured | `show ntp servers` |
| NTP current status | `show ntp current` |
| Login banner | `show message banner` |
| Active administrators | `show users` |
| Interface configuration | `show interfaces all` |

### Control Plane

| Function | CLI Command |
|----------|-------------|
| OSPF routing configuration | `show route ospf` |
| OSPF config detail | `show configuration ospf` |
| BGP summary | `show route bgp` |
| Connection rate limits | `show connections limit` |
| Anti-spoofing status | `fwaccel stat` |
| Cluster status (HA) | `cphaprob stat` |
| SecureXL acceleration status | `fwaccel stat` |

### Data Plane

| Function | CLI Command |
|----------|-------------|
| Firewall policy status | `fw stat -l` |
| Security policy rule count | `fw stat` |
| Active connections table | `fw tab -t connections -s` |
| Implied rules status | `fw ctl get int implied_rules` |
| Enabled software blades | `enabled_blades` |
| IPS/Threat Prevention status | `cpstat -f all threat_prevention` |
| HTTPS inspection policy | `show https-inspection policy` |
| Interface statistics | `show interfaces all` |
| Routing table | `show route` |


path: references/control-reference.md
content: # CIS Benchmark Control Reference — Network Device Audit Mapping

Copyright-safe reference mapping CIS benchmark control IDs and section
categories to audit areas and verification commands. This file cites CIS
control identifiers as factual references and provides independently-written
descriptions of configuration areas to audit.

**Copyright notice:** CIS benchmark documents are commercially licensed by
the Center for Internet Security. This reference does NOT reproduce benchmark
text, remediation instructions, rationale, or scoring methodology. Operators
must obtain their own licensed copy of the applicable CIS benchmark for full
control descriptions. Control IDs below are factual references for
traceability.

## Cisco IOS

### Management Plane

| CIS Section | Category | Config Area to Check | Audit CLI |
|-------------|----------|---------------------|-----------|
| 1.1.1 | AAA Services | Whether AAA is globally enabled for authentication | `show running-config \| include aaa new-model` |
| 1.1.2 | AAA Services | Whether AAA authentication is configured for login sessions | `show running-config \| section aaa authentication` |
| 1.1.3 | AAA Services | Whether AAA authorization is active for exec and command levels | `show running-config \| section aaa authorization` |
| 1.1.4 | AAA Services | Whether AAA accounting records login and command events | `show running-config \| section aaa accounting` |
| 1.2.1 | Access Rules | Whether only SSH (no Telnet) is permitted on VTY lines | `show running-config \| section line vty` |
| 1.2.2 | Access Rules | Whether ACLs restrict VTY access to authorized management hosts | `show running-config \| section line vty` |
| 1.2.3 | Access Rules | Whether auxiliary port is disabled | `show running-config \| section line aux` |
| 1.3.1 | Banner | Whether a login warning banner is configured | `show running-config \| include banner` |
| 1.4.1 | Password Management | Whether local user passwords use strong hashing | `show running-config \| include username` |
| 1.4.2 | Password Management | Whether enable secret uses type 9 (scrypt) hashing | `show running-config \| include enable` |
| 1.5.1 | SNMP | Whether SNMP community strings are non-default and access-restricted | `show snmp community` |
| 1.5.2 | SNMP | Whether SNMPv3 with auth and encryption is used instead of v1/v2c | `show snmp group` |
| 1.6.1 | Logging | Whether syslog is configured to send events to a remote server | `show running-config \| include logging host` |
| 1.6.2 | Logging | Whether logging includes timestamps with millisecond precision | `show running-config \| include service timestamps` |
| 1.7.1 | NTP | Whether NTP uses authenticated trusted sources | `show ntp associations` |

### Control Plane

| CIS Section | Category | Config Area to Check | Audit CLI |
|-------------|----------|---------------------|-----------|
| 2.1.1 | Routing Authentication | Whether OSPF neighbor authentication is configured per area | `show ip ospf interface \| include authentication` |
| 2.1.2 | Routing Authentication | Whether BGP neighbors require TCP MD5 or AO authentication | `show ip bgp neighbors \| include password` |
| 2.2.1 | Control Plane Protection | Whether CoPP policy is applied to the control plane | `show policy-map control-plane` |
| 2.3.1 | ARP Security | Whether Dynamic ARP Inspection is enabled on access VLANs | `show ip arp inspection vlan` |
| 2.3.2 | DHCP Security | Whether DHCP snooping is active on access VLANs | `show ip dhcp snooping` |

### Data Plane

| CIS Section | Category | Config Area to Check | Audit CLI |
|-------------|----------|---------------------|-----------|
| 3.1.1 | IP Filtering | Whether explicit deny with logging exists at ACL boundaries | `show ip access-lists` |
| 3.2.1 | uRPF | Whether unicast RPF is enabled on external-facing interfaces | `show ip interface \| include verify` |
| 3.3.1 | Storm Control | Whether broadcast storm control thresholds are set on access ports | `show storm-control broadcast` |
| 3.3.2 | Port Security | Whether 802.1X or port security limits MAC addresses on edge ports | `show dot1x all summary` |

## PAN-OS

### Management Plane

| CIS Section | Category | Config Area to Check | Audit CLI |
|-------------|----------|---------------------|-----------|
| 1.1.1 | Admin Access | Whether management interface access is restricted by source IP | `show running management-profile` |
| 1.1.2 | Admin Access | Whether idle timeout is configured for administrative sessions | `show config running \| match idle-timeout` |
| 1.2.1 | Authentication | Whether authentication profile is bound to admin accounts with external auth | `show config running \| match authentication-profile` |
| 1.2.2 | Authentication | Whether password complexity requirements are configured | `show config running \| match password-complexity` |
| 1.3.1 | Logging | Whether syslog forwarding is configured to a remote collector | `show config running \| match syslog` |
| 1.3.2 | Logging | Whether system, config, and traffic logs are forwarded | `show logging-status` |
| 1.4.1 | SNMP | Whether SNMPv3 is used with authPriv security level | `show config running \| match snmp` |
| 1.5.1 | Banner | Whether a login banner is configured on management interfaces | `show config running \| match login-banner` |

### Control Plane

| CIS Section | Category | Config Area to Check | Audit CLI |
|-------------|----------|---------------------|-----------|
| 2.1.1 | Routing Authentication | Whether OSPF area authentication is enabled | `show routing protocol ospf area` |
| 2.1.2 | Routing Authentication | Whether BGP peer authentication is configured | `show routing protocol bgp peer` |
| 2.2.1 | Session Protection | Whether DoS protection profiles are applied to critical zones | `show running dos-policy` |

### Data Plane

| CIS Section | Category | Config Area to Check | Audit CLI |
|-------------|----------|---------------------|-----------|
| 3.1.1 | Security Policy | Whether security policy has explicit deny-all at bottom with logging | `show running security-policy` |
| 3.1.2 | Security Policy | Whether allow rules bind Security Profile Groups for threat inspection | `show running profile-group` |
| 3.2.1 | Zone Protection | Whether zone protection profiles are assigned to all active L3 zones | `show running zone-protection-profile` |
| 3.3.1 | Decryption | Whether SSL decryption is enabled for internet-bound traffic | `show running ssl-decryption-policy` |

## JunOS

### Management Plane

| CIS Section | Category | Config Area to Check | Audit CLI |
|-------------|----------|---------------------|-----------|
| 1.1.1 | System Access | Whether TACACS+/RADIUS is configured as primary authentication source | `show configuration system authentication-order` |
| 1.1.2 | System Access | Whether root login is restricted to console only | `show configuration system root-authentication` |
| 1.2.1 | SSH | Whether only SSHv2 is enabled (no Telnet, no SSHv1) | `show configuration system services ssh` |
| 1.2.2 | SSH | Whether SSH rate limits and connection limits are configured | `show configuration system services ssh rate-limit` |
| 1.3.1 | Logging | Whether syslog targets include a remote host at appropriate severity | `show configuration system syslog` |
| 1.3.2 | SNMP | Whether SNMPv3 with USM authentication is configured | `show configuration snmp v3` |
| 1.4.1 | NTP | Whether NTP uses authentication keys for all configured servers | `show configuration system ntp` |
| 1.5.1 | Login | Whether login message/banner is configured | `show configuration system login message` |

### Control Plane

| CIS Section | Category | Config Area to Check | Audit CLI |
|-------------|----------|---------------------|-----------|
| 2.1.1 | Routing Authentication | Whether OSPF interfaces require authentication | `show ospf interface detail` |
| 2.1.2 | Routing Authentication | Whether BGP peers have authentication keys configured | `show bgp neighbor \| match AuthKey` |
| 2.2.1 | RE Protection | Whether firewall filter on lo0 protects the routing engine | `show configuration firewall filter` |
| 2.3.1 | ICMP Control | Whether ICMP rate limiting is configured | `show configuration firewall policer` |

### Data Plane

| CIS Section | Category | Config Area to Check | Audit CLI |
|-------------|----------|---------------------|-----------|
| 3.1.1 | Filtering | Whether firewall filters include discard with logging as final term | `show configuration firewall family inet` |
| 3.2.1 | uRPF | Whether RPF check is enabled on upstream interfaces | `show configuration interfaces \| match rpf-check` |
| 3.3.1 | Storm Control | Whether storm control is enabled on access-facing interfaces | `show configuration ethernet-switching-options storm-control` |

## Check Point

### Management Plane

| CIS Section | Category | Config Area to Check | Audit CLI |
|-------------|----------|---------------------|-----------|
| 1.1.1 | Admin Access | Whether management GUI access is restricted by source IP | `show web ssl-port` and `show allowed-client` |
| 1.1.2 | Admin Access | Whether session timeout is configured for GUI and CLI | `show inactivity-timeout` |
| 1.2.1 | Authentication | Whether RADIUS/TACACS+ is configured for administrator authentication | `show configuration aaa` |
| 1.2.2 | Password Policy | Whether password complexity and history rules are enforced | `show password-controls` |
| 1.3.1 | Logging | Whether logs are forwarded to a remote log server (SmartLog/syslog) | `show logging` |
| 1.3.2 | SNMP | Whether SNMPv3 is configured with authentication and privacy | `show snmp agent-version` |
| 1.4.1 | NTP | Whether NTP servers are configured with authentication | `show ntp servers` |
| 1.5.1 | Banner | Whether a warning message is configured for login | `show message banner` |

### Control Plane

| CIS Section | Category | Config Area to Check | Audit CLI |
|-------------|----------|---------------------|-----------|
| 2.1.1 | Routing Authentication | Whether OSPF authentication is enabled on routing interfaces | `show route ospf` and `show configuration ospf` |
| 2.2.1 | Connection Limits | Whether connection rate limiting is configured for the management plane | `show connections limit` |
| 2.3.1 | ARP Protection | Whether anti-spoofing is enabled on gateway interfaces | `fwaccel stat` and `fw ctl get int fw_antispoofing` |

### Data Plane

| CIS Section | Category | Config Area to Check | Audit CLI |
|-------------|----------|---------------------|-----------|
| 3.1.1 | Security Policy | Whether an explicit drop-all cleanup rule with logging exists at rulebase bottom | `fw stat -l` |
| 3.1.2 | Security Policy | Whether implied rules are reviewed and unnecessary ones disabled | `fw ctl get int implied_rules` |
| 3.2.1 | IPS | Whether IPS/Threat Prevention blade is enabled on security gateway | `enabled_blades` |
| 3.3.1 | HTTPS Inspection | Whether HTTPS inspection is enabled for outbound traffic | `show https-inspection policy` |


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)