✓

CIS Quick Check

Track a baseline hardening score

50%baseline

4 of 8 controls confirmed

Self-assessment snapshot — not a CIS audit.

Introduction

CIS Quick Check is a lightweight scorecard of eight baseline controls drawn from the spirit of the CIS Benchmarks — not a substitute for running the actual benchmark tools.

You confirm which controls are in place, and the tool shows a percentage and a short list of what remains. It is meant for a first pass before a real hardening review.

Objective

Provide a memorable, checkable baseline of eight controls.
Show a single score so progress is visible across servers.
Distinguish clearly between the checklist (what you confirmed) and the actual CIS benchmark (what you should still run).

Inputs

A checkmark per control, based on what you verified on the target host.
Controls: SSH root login disabled, host firewall enabled, time synchronisation, audit service, unused filesystems disabled, automated security updates, password policy, remote logging.

How it works

The score is the percentage of confirmed controls: confirmed count divided by eight, rounded to a whole number.

The score is a self-assessment snapshot: it reflects what you marked, not an automated scan of the host.

No control is weighted; each contributes equally, which keeps the score easy to explain.

Testable example

Try it — the analysis runs locally in your browser.

Example

Confirmed: SSH root login disabled, host firewall enabled, time synchronisation, audit service, automated updates.

Expected output

Score: 63%
5 of 8 controls confirmed.
Remaining: unused filesystems disabled, password policy enforced, remote logging configured.

Reading the output

A high score with honest confirmations is a good start; a low score tells you where to focus first.
Treat the checklist as a conversation starter with your team, not as compliance evidence.
For formal compliance, run the vendor's benchmark tooling (for example CIS-CAT or the distribution's hardening guides) on the actual host.

Risks

A self-assessed score can create false confidence if checks are marked without verification.
The eight controls cover only a small slice of a complete baseline.
Controls interact: enabling auditd without configuring what it records provides little value.

Limitations

This is not the CIS benchmark, and OthoTools is not endorsed or certified by the Center for Internet Security.
It is a manual checklist — nothing is scanned on your machine.
The control set is fixed and cannot be extended in this version.

Official references

FAQ

Is this an official CIS benchmark?

No. It is an eight-item self-assessment inspired by the benchmark's spirit. Run the actual CIS tooling for compliance work.

Which firewall should I confirm?

Any host firewall that is enabled and whose rules you understand — ufw, firewalld or nftables. The checklist only asks whether one is active.

Why remote logging?

Local logs are lost when a host is compromised or destroyed. Sending logs to a remote collector is a cheap way to preserve evidence.