Auditing CIS Benchmark Compliance

Assesses a self-hosted CockroachDB cluster against the CIS CockroachDB Benchmark v1.0.0 Level 1 profile. Evaluates 30 controls across six domains: installation and patches, system hardening and topology, logging and monitoring, user access and authorization, data protection, and CockroachDB settings. Produces a structured report with PASS, FAIL, and MANUAL REVIEW findings, including CIS Controls v7/v8 mappings with Implementation Group coverage.

Scope: Self-hosted CockroachDB deployments only. For CockroachDB Cloud clusters, use auditing-cloud-cluster-security instead — Cloud clusters have managed controls that supersede many CIS self-hosted checks.

Authoritative source: This skill implements the benchmark defined at https://github.com/cockroachlabs/CIS-benchmarks-crdb

Read-only audit: All operations are read-only. No cluster state, OS configuration, or files are modified during the assessment.

When to Use This Skill

• Preparing for a CIS benchmark compliance assessment or external audit
• Hardening a new self-hosted CockroachDB production deployment
• Validating security posture against industry-standard benchmarks
• Performing periodic compliance checks as part of security operations
• Mapping CockroachDB security controls to CIS Controls frameworks
• Responding to auditor requests for CIS benchmark evidence