An organization passed a CIS benchmark audit last year, but emergency changes have since introduced configuration drift. Leadership wants benchmark compliance verified continuously rather than once a year. Which approach fits?
Select an answer to reveal the explanation.
Short Explanation
An annual audit is a yearly physical: useful, but it won't catch the problem that started in February. Continuous assessment is the fitness tracker on your wrist, checking all the time and telling you the moment something drifts. The traps are all once-a-year fixes wearing different clothes.
Full Explanation
Point-in-time audits show compliance on the day they run, and drift begins with the next change. Continuous compliance uses automated tools that collect device configurations on a schedule or after each change, evaluate them against the benchmark's audit checks, and report failed items and trends. CIS provides assessment tooling for its benchmarks, and network configuration management platforms can apply equivalent policy checks. Because evaluation is automated and frequent, drift introduced by an emergency change is detected within the assessment interval and can be fed into ticketing for remediation or exception review. A yearly manual review by an external auditor is the current model the stem wants to move beyond; it is periodic and labor-intensive and finds drift months late. A change freeze until the next audit is operationally unrealistic, does not detect drift already present, and conflicts with the emergency changes the organization needs. A remediation script run after each audit restores the baseline only at that moment and leaves the rest of the year unmonitored. Exam caveat: continuous assessment depends on accurate device inventory, since unlisted devices are never assessed. Operational check: confirm every in-scope device appears in the assessment tool, review the schedule and the latest results, and test detection by changing a benchmark setting on a lab device.