Skip to main content
Solved

Compliance Benchmarks - CIS Control reference numbers not included

  • January 21, 2025
  • 8 replies
  • 5 views

Forum|alt.badge.img+9

I've filled out the survey, also going to post separately.

I think it would be really beneficial to include the CIS control reference numbers in the UI so we can easily see if we're compliant on a specific control

For organisations where there's a demarcation between client administration, and Information Security, the CIS control reference numbers become critical to ensure we're talking about the same thing, and are often used in other vulnerabliity management/scanning tools.

Best answer by JanVozenilek85

Hi @grahamr and @statusBrew 

I am happy to share that the CIS rule numbers you've been asking for are now shown in the Compliance module of Jamf Pro (which is in version 11.16 beta). We will be glad if you can look around and let us know any thoughts - mainly if that helps you to better navigate within the new capability.

 

8 replies

Forum|alt.badge.img+9
  • Contributor
  • January 22, 2025

Yup! posted this as well - if you are going to tout the CIS l1 or l2 as the base, the control number needs to be "somewhere"

 


Tomas_Lukl1
Forum|alt.badge.img+6
  • Employee
  • January 27, 2025

Hi @statusBrew and @grahamr . Thank you for the feedback. Just to be 100% sure. Are you talking about the control numbers that are also displayed by each rule in Jamf Compliance Editor? e.g. "3.1 Enable Security Auditing" -> "3.1" being the control number?


Forum|alt.badge.img+9
  • Author
  • Contributor
  • January 27, 2025

Hi @statusBrew and @grahamr . Thank you for the feedback. Just to be 100% sure. Are you talking about the control numbers that are also displayed by each rule in Jamf Compliance Editor? e.g. "3.1 Enable Security Auditing" -> "3.1" being the control number?


Hi @Tomas_Lukl1 - personally, I've not used the Jamf Compliance Editor.
But, I'm referring to the control numbers listed on the CIS documentation

For example, Enforce on Device Dictation is shown like the below in the Compliance settings in Jamf Pro


This is the same control in the CIS Documentation:

 

This feedback is that it would be very useful to have 2.18.1 listed in the title of the compliance setting in Jamf Pro.

 

 


Forum|alt.badge.img+9
  • Contributor
  • January 27, 2025

Hi @statusBrew and @grahamr . Thank you for the feedback. Just to be 100% sure. Are you talking about the control numbers that are also displayed by each rule in Jamf Compliance Editor? e.g. "3.1 Enable Security Auditing" -> "3.1" being the control number?


Ideally, in the same way the OS applicability is noted, the CIS (nist, stig) control number, and the macOS security compliance project reference would be visible “somewhere” and searchable. So I could just type 2.18. And see all those branching controls (using the other example) 


JanVozenilek85
Forum|alt.badge.img+9

Thank you both for your feedback! Could you please have a look at the quick mockup and tell us if that does the trick?

 


Forum|alt.badge.img+9
  • Author
  • Contributor
  • January 27, 2025

Thank you both for your feedback! Could you please have a look at the quick mockup and tell us if that does the trick?

 


Without playing around, it looks like it'll do the trick for me!
On the same vein, there's no "Select/Deselect All" button for en-masse management.

The scenario I'm thinking of would be where we want to control specific rules, and ideally I'd:

  1. Create a new baseline
  2. Deselect all
  3. Search for specific controls with the control number, select them
  4. Save and deploy

 

I can open a new thread if that would be beneficial.


Forum|alt.badge.img+9
  • Contributor
  • January 27, 2025

Thank you both for your feedback! Could you please have a look at the quick mockup and tell us if that does the trick?

 


Using the same MSCP 3.5 CIS reference in JCE when you expand References, you get all the control numbers for the different benchmarks. 

So provided the 3.5 - Title and 4.5 - Title are the CIS control numbers, this would work for us. If its the case would they dynamically change if a different benchmark is used? (like JCE does, when a different benchmark is added later?)

if not, maybe a "references" section like in JCE that is sortable or filterable would also work

 

Edit: also and unrelated i HATE the recaptcha implementation on this site it makes me not want to post. it times out, takes 2-3 validations to do, and we are already in a section that is private - so i dont understand the value its adding. 


JanVozenilek85
Forum|alt.badge.img+9

Hi @grahamr and @statusBrew 

I am happy to share that the CIS rule numbers you've been asking for are now shown in the Compliance module of Jamf Pro (which is in version 11.16 beta). We will be glad if you can look around and let us know any thoughts - mainly if that helps you to better navigate within the new capability.