Security Compliance · Cross-Platform

OS Compliance Audit

Compliance audit procedures for Linux & Windows estates — evaluated against CIS Level 1 Server, PCI-DSS, and Microsoft Security Baselines to enforce security best practices and regulatory compliance.

OpenSCAP Microsoft SCT CIS Level 1 PCI-DSS Security Baselines

Executive Summary

This guide outlines comprehensive compliance audit procedures across Linux and Windows estates. Linux systems use OpenSCAP and the SCAP Security Guide evaluated against CIS Level 1 Server and PCI-DSS benchmarks. Windows hosts use the Microsoft Security Compliance Toolkit (SCT) with Policy Analyzer to compare live state against official Microsoft Security Baselines.

Host config probed Benchmark evaluation sweep Non-compliant finding

Figure 1 — Live audit flow. The scanner reads the host's live configuration, sweeps it against the CIS / PCI-DSS benchmark, and emits a color-coded pass/fail report.

Ubuntu 24.04 LTS Server

// initial compliance audit · OpenSCAP scanner

CIS Level 1 Server

01 System Update

Update the package repository and upgrade existing packages so the system has the latest security patches before scanning.

bash

sudo apt update
sudo apt upgrade

02 Install OpenSCAP Tools

Install the core OpenSCAP scanner and utilities required for compliance scanning.

bash

sudo apt install -y openscap-scanner openscap-utils

03 Install SCAP Security Guide Dependencies

Install additional SCAP Security Guide packages for Debian-derived systems.

bash

sudo apt install -y ssg-debderived
sudo apt install -y ssg-base

04 Install Unzip Utility

Ensure unzip is available for extracting the security guide archive.

bash

sudo apt update && sudo apt install -y unzip

05 Download SCAP Security Guide

Download the latest SCAP Security Guide content package from the official ComplianceAsCode repository.

bash

wget https://github.com/ComplianceAsCode/content/releases/latest/download/scap-security-guide-0.1.79.zip

06 Extract Security Guide

Extract the downloaded archive to access the compliance content.

bash

unzip scap-security-guide-0.1.79.zip
cd scap-security-guide-0.1.79

07 Locate Ubuntu 24.04 Data Stream

Find the specific SCAP data stream file for Ubuntu 24.04.

bash

find . -name "*ubuntu2404-ds.xml"

08 Review Available Profiles

Display information about available compliance profiles in the data stream — CIS benchmarks, DISA STIG, and other frameworks.

bash

oscap info ssg-ubuntu2404-ds.xml

09 Execute Compliance Audit

Run the comprehensive compliance scan against the CIS Level 1 Server profile.

What this command does:

Evaluates the system against CIS Level 1 Server benchmark controls
Generates detailed XML results file: ubuntu2404-cis-results.xml
Creates an HTML report for easy review: ubuntu2404-cis-report.html

bash

sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_level1_server \
  --results ubuntu2404-cis-results.xml \
  --report ubuntu2404-cis-report.html \
  ssg-ubuntu2404-ds.xml

Open ubuntu2404-cis-report.html in a browser to review pass/fail details for every control

Windows 10 / 11

// security compliance audit · Microsoft Security Baselines

Microsoft SCT

Purpose

A standardized workflow for auditing a Windows 10 / 11 system against the official Microsoft Security Baselines. This process identifies security "loopholes" (misconfigurations) by comparing the machine's live state against Microsoft's recommended hardened state.

Required Toolset

Unlike older methods (like SCM 4.0), modern auditing uses the Microsoft Security Compliance Toolkit (SCT). Download the following from Microsoft:

Toolkit Components:

Policy Analyzer — the comparison engine
Windows 10 / 11 Security Baselines — the "Gold Standard" configuration files (GPOs)
LGPO.exe — used to export local policy or apply the hardening

Download Microsoft SCT

Pre-Implementation

⚠ Important: Before starting, ensure all tools are fully extracted from their .zip files. Running these tools from within a compressed folder will cause the audit to fail.

Phase A Creating the Baseline Reference

Convert GPO Files to Policy Rules

To audit a system, first convert Microsoft's GPO files into a format the analyzer can read.

Procedure:

Launch PolicyAnalyzer.exe as Administrator
Click Add → File → Add files from GPO(s)
Browse to the extracted Windows 10 / 11 Security Baseline folder
Select the GPOs sub-folder and click Import
Save the resulting file (e.g., Win10-11_25H2_Baseline.PolicyRules)

Phase B Performing the Audit

Compare to Effective State

This phase identifies the differences between the local machine and the baseline.

Procedure:

In Policy Analyzer, check the box next to your newly created .PolicyRules file
Click Compare to Effective State
The tool queries the local Registry and Group Policy, then compares them to the baseline

Phase C Interpreting the Audit Results

Color-Coded Result Grid

Results are displayed in a color-coded grid that maps directly to compliance state:

White — CompliantYour setting matches Microsoft's recommendation.

Yellow / Red — ConflictThe machine is configured differently than the baseline.

Grey — MissingThe baseline requires a setting the machine hasn't configured at all.

Phase D Generating the Hardening Report

Export to Excel

To share findings with stakeholders:

In the comparison viewer, click Export → Export to Excel
This document serves as the "Loophole List" that needs to be remediated

Remediation — Hardening the Loopholes

Once the audit is complete, the system can be hardened using one of two methods:

Method 1 — Automated Hardening (Bulk)

Apply the entire baseline at once using the LGPO.exe tool via Command Prompt:

cmd

LGPO.exe /g "C:\Path\To\Baseline\GPOs"

Method 2 — Manual Hardening (Granular)

For specific high-risk items (such as LSA Protection or SMBv1), manually update the registry paths identified in the Policy Analyzer report.

Verification

A compliance audit is not complete until it is verified. After applying fixes:

Re-run Phase B (Compare to Effective State)
Ensure all previously flagged rows are now White

Audit complete when no Yellow / Red / Grey rows remain

Oracle Linux 8 & 9

// CIS benchmark with remediation · PCI-DSS audit

CIS · PCI-DSS

01 Install SCAP Security Guide

Install the SCAP Security Guide package which contains security policies and compliance profiles for Oracle Linux.

bash

sudo dnf install -y scap-security-guide

02 View Available Security Profiles

Before running the audit, understand what security profiles are available in the SCAP content for Oracle Linux 9 — including benchmarks and compliance standards.

bash

sudo oscap info "/usr/share/xml/scap/ssg/content/ssg-ol9-ds.xml"

03 Run CIS Benchmark Audit with Remediation

Execute the CIS benchmark audit. This scan evaluates the system against CIS standards and automatically applies remediation where possible.

⚠ Important: The --remediate flag automatically fixes non-compliant settings. Take a system snapshot before running this in production environments.

bash

sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis \
  --remediate \
  /usr/share/xml/scap/ssg/content/ssg-ol9-ds.xml

04 Run PCI-DSS Compliance Audit

Execute the PCI-DSS (Payment Card Industry Data Security Standard) compliance audit. This scan generates detailed reports in both XML and HTML formats for review and client presentation.

bash

sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_pci-dss \
  --results-arf /tmp/pci-dss-arf.xml \
  --report /tmp/pci-dss-report.html \
  /usr/share/xml/scap/ssg/content/ssg-ol9-ds.xml

Output files:

/tmp/pci-dss-arf.xml — machine-readable results in ARF (Asset Reporting Format)
/tmp/pci-dss-report.html — human-readable HTML report for client presentation

Why This Matters

Automated compliance audits with OpenSCAP turn a multi-day manual review into a single command. The same XML/HTML report can be submitted to auditors, attached to change tickets, or piped into a SIEM for trending — every Linux host in the fleet measured against the same yardstick.

Real-world impact at Neo Solutions & 7 Kings Code:

Standardized vulnerability assessment across Ubuntu and Oracle Linux estates
Drove compliance posture for SOC 2 & PCI-DSS readiness checks
Established a repeatable baseline that catches drift on every redeploy