In our previous blog post, [Real-time Azure v2.0.0 CIS Benchmark assessments](https://turbot.com/guardrails/blog/2024/05/real-time-azure-cis-benchmark), we showed how Turbot Guardrails enables continuous monitoring of your Azure environment against the CIS v2.0.0 Benchmark. Guardrails discovers changes in real-time, instantly evaluates compliance, sends alerts when misconfigurations are detected, and takes quick actions to immediately apply fixes. But what if you could automatically fix those misconfigurations and maintain a secure and compliant environment without manual intervention? With Turbot Guardrails' auto-remediation policies, you can. ## Effortless CIS compliance with auto-remediation Traditional security incident management relies on manual processes to address misconfigurations identified in periodic assessments. This approach is time-consuming, error-prone, and leaves your environment vulnerable between scans. Turbot Guardrails takes CIS assessments to the next level with auto-remediation policies. Guardrails detects configuration drift in real-time, evaluates the change for a misconfiguration, and can automatically take action to fix the issue and bring the resource back into compliance with the Azure CIS v2.0.0 Benchmark. **Key benefits of Turbot Guardrails' auto-remediation policies:** - **Continuous compliance:** As soon as a misconfiguration is detected, Guardrails automatically remediates the issue, ensuring your environment remains compliant with CIS recommendations at all times. - **Reduced security operations overhead:** Auto-close incidents. Eliminate the need for manual intervention and free up your team to focus on higher-value tasks. Guardrails handles the heavy lifting of maintaining compliance. - **Customizable policies:** Define auto-remediation policies that align with your organization's specific requirements and risk posture. Set different policies for different accounts, regions, resources, or per specific resource configurations. Set time-based exceptions to ignore recommendations per cloud account or per resource when not applicable. - **Audit trail:** Guardrails keeps a detailed record of all auto-remediation actions taken, providing a complete audit trail for compliance reporting and troubleshooting. - **Comprehensive coverage:** Guardrails provides over 10,000+ security and operational policies OOTB for AWS, Azure, GCP, Kubernetes and ServiceNow, so you can centralize your security posture management efforts across your entire cloud infrastructure. ## How to enable auto-remediation for Azure CIS v2.0.0 using Guardrails ### Prerequisite: Install the Azure CIS mods If you haven't already, install the `@turbot/cis` and the `@turbot/azure-cisv2-0` mods, and enable the `Azure > CIS v2.0` policy to `Check: All CIS Benchmarks` as described in our previous [blog post](<(https://turbot.com/guardrails/blog/2024/05/real-time-azure-cis-benchmark)>). Installing the CIS mods will also ensure you have the appropriate `azure-*` dependent mods. ### Remediation for a control You can focus on specific CIS Benchmark recommendations and set policies that map to them. For example, `3.15 Ensure the 'Minimum TLS version' for storage accounts is set to 'Version 1.2'` has a number of storage accounts that are not meeting the related CIS recommendation.

To remediate, use the following `Azure > Storage > Storage Account > Minimum TLS Version` policy to enforce the minimum TLS version setting:

Guardrails CIS remediation policy settings for section Azure v2 3.1.5

Once the policy is set to enforce, Guardrails will immediately remediate all applicable Azure storage accounts in scope:

Guardrails CIS remediation activity for section Azure v2 3.15

All the buckets were remediated and now the CIS recommendation 3.15 is showing 'green' for the controls:

Guardrails CIS now green for section Azure v2 3.15

Now that enforcement policies are set, Guardrails will continuously monitor and take action whenever a new bucket is created or an existing bucket is misconfigured. ### Remediation for a CIS section While you can set your own policies to remediate CIS recommendations, you can also leverage the collection of open-source policy samples available in the [Guardrails Samples repository](https://github.com/turbot/guardrails-samples). Included in the repo are [Policy Packs](https://github.com/turbot/guardrails-samples/tree/main/policy_packs) which are a collection of policies that can be applied to your cloud resources. Specifically for Azure CIS v2.0.0, there is a collection of [Azure CIS v2.0.0 remediation Policy Packs](https://github.com/turbot/guardrails-samples/tree/main/policy_packs/azure/cis_v200) that can be applied to your Guardrails workspace.

In the Acme environment, there are a number of Application Services resources which don't adhere to the broader set of Azure CIS v2.0.0 Section 9 recommendations.

Guardrails CIS Remediation Section 9 Alerts

Using `Azure CIS v2.0.0 Section 9 - Application Services` Policy Pack as an example, we can apply a group of preset policies to cover the Section 9 recommendations.

Guardrails CIS Remediation Section 9 Policy Pack

To apply the Policy Pack policies, you can attach it to any resource. In this case we attach it to the `Acme` folder which contains a few Azure subscriptions.

Guardrails CIS Remediation Policy Pack Attachment

Once the Policy Pack is attached, Guardrails will immediately remediate all applicable app services resources in scope:

Guardrails CIS remediation activity for section 9 of Azure v2.0.0

All the storage account resources were remediated and now Section 3 of the CIS Benchmark is showing 'green' for the controls:

Guardrails CIS now green for section 9 of Azure v2.0.0

## See it in action

## Level up your compliance game with Guardrails Take your Azure CIS v2.0.0 Benchmark compliance to the next level with Turbot Guardrails' auto-remediation policies. With continuous monitoring, instant remediation, and detailed audit trails, Guardrails makes it effortless to maintain a secure and compliant cloud environment. Try it now with a [14-day free trial](https://turbot.com/start) and see how easy it is to keep your Azure environment aligned with CIS best practices. Looking for AWS & GCP CIS guardrails? Guardrails also supports auto-remediation policies and covers the latest CIS benchmark assessments for [AWS](/guardrails/blog/2024/05/instant-aws-cis-v3-compliance) and [GCP](/guardrails/blog/2024/07/instant-gcp-cis-v2-compliance).

Get to green with real-time remediation for Azure CIS v2.0.0