Benchmark Mapping with CIS data

Benchmark Mapping helps you find which benchmark rules correspond to the settings in your baseline. It is an optional review tool available in both editions; you can author and compare baselines without setting it up.

Bring your own data. ConfigForge does not bundle CIS Benchmark data. Supply a legally licensed copy and follow its redistribution terms.

The editor cross-reference drawer and Diff page CIS Diff tab are hidden until supported CIS data is present. The Benchmark Mapping sidebar page remains visible so users can see the resolved data folder and setup guidance. No OSConfig CLI is required.

Coverage is not device compliance. A rule match does not prove that the configured value meets the benchmark, that a machine has that value, or that the baseline is certified. Review mappings and values, and use device Audit separately when you need a machine-state check.

What this feature does (when enabled)

Two related but distinct features sit on top of CIS Benchmark data:

1. Cross-reference - for each resource in your manifest, show the matching CIS rule (ID, severity, GPO path) inline in the editor drawer.
2. CIS Diff coverage scoring - score your manifest against a full CIS baseline on the Diff → CIS Diff tab: "Your custom WS2025 baseline covers X% of the CIS WS2025 baseline you supplied."

When CIS data is not present (the default for a fresh clone), the editor cross-reference drawer and the Diff page's CIS tab are hidden. The rest of the authoring experience (editor, history, rationale, Audit Pack, pairwise diff, and matrix diff) works exactly the same. Full-edition device operations are also unaffected.

Ingestion paths

ConfigForge supports three ways to supply CIS data. You only need one of these paths. The app resolves the correct location at runtime and shows the active path on the Benchmark Mapping page. In a dev checkout the folder is public/_baselines/cis/_data; in packaged builds it resolves under the app's public assets as _baselines/cis/_data.

1. Azure Policy CIS baseline JSON (primary, recommended)

If you already have a supported CIS settings catalog in Azure Policy JSON format, use it directly:

1. Confirm the file contains a settingsReference array of benchmark settings for the OS you want to compare. An arbitrary policy definition or assignment JSON is not a benchmark catalog.
2. Copy the JSON into the exact folder shown on Benchmark Mapping.
3. Select Re-check catalog and inspect the detected file/platform status.

This route does not require signing in to Azure. JSON catalogs may represent only a subset of a benchmark; coverage is relative to the data you supply.

2. XCCDF + OVAL XML (alternative)

If you have a CIS Workbench subscription, you can use the raw XCCDF and OVAL files directly.

1. Download the XCCDF and OVAL XML files from CIS Workbench.
2. Drop the files as-is into _baselines/cis/_data (or the exact folder shown on the Benchmark Mapping page).
3. Click Re-check catalog on the Benchmark Mapping page.

The app reads XCCDF structure and OVAL definitions to build the mapping table at startup.

3. Legacy OSConfig pipeline JSON (advanced)

This is the legacy cis-mappings.json format used by earlier versions of ConfigForge and the OSConfig mc/CIS scripts. It remains supported for backward compatibility.

1. Generate the mapping artifacts using the upstream OSConfig PowerShell scripts from a CIS XCCDF + OVAL pair you supply.
2. Place the resulting JSON files in _baselines/cis/_data (or the exact folder shown on the Benchmark Mapping page).
3. Click Re-check catalog on the Benchmark Mapping page.

The expected JSON shapes are documented in the packages/core/src/cis/data.ts type definitions (CisGlobalMappings, CisRuleCatalog, etc.).

Tip: You do not need to remember exact file paths. The Benchmark Mapping page in the app displays the resolved data directory for your installation. Place files there and click Re-check catalog.

Cross-reference (Benchmark Mapping + editor drawer)

The Benchmark Mapping sidebar page detects the files in _baselines/cis/_data, shows their source format, and explains the resolved folder. When data is available, the manifest editor drawer cross-references each resource and shows:

Strict match is the default. If myResource.name matches a CIS rule's name exactly, the match is high-confidence.

Property-mapping fallback (lower confidence): when strict match fails, the engine checks whether the resource is a recognized type:

• Microsoft.Windows/AccountPolicy - match properties.name against the osconfigProperty field, then search the rule catalog for a matching friendly name.
• Microsoft.Windows/UserRightsAssignment - match properties.name (e.g. SeSecurityPrivilege) against the userRights.*.privilege field.
• Microsoft.Windows/AuditPolicy - match properties.subcategory GUID against the audit subcategory mapping.

The drawer marks property-mapping matches with a verification pill so the author knows to review them.

Note: A high-confidence match means the names/identity agree. Neither that match nor the CIS Diff coverage percentage proves that the values agree. Review the desired values and the benchmark's requirements separately.

CIS Diff coverage report

On the Diff page, open the CIS Diff tab, choose a manifest and optionally a benchmark, then click Compare against CIS. You will see:

covered CIS rules        35
missing CIS rules         12
manifest resources matched 42 / 50
coverage                  74.5%

The main score is computed strictly:

• covered CIS rules - unique CIS benchmark rules with at least one matching manifest resource.
• missing CIS rules - benchmark rules with no matching manifest resource.
• manifest resources matched - secondary diagnostic; multiple resources can map to the same CIS rule.
• coverage = covered CIS rules / total benchmark rules * 100.

Tip: coverage == 100 means every supplied CIS rule has at least one matching resource. It does not mean the values are correct, that the manifest is identical to the benchmark, or that any device is compliant.

When CIS data is not available

If CIS data is missing, the CIS Diff tab is hidden and the Benchmark Mapping page renders a friendly empty state explaining the license restriction and pointing at the data folder. No broken dropdown, no crash.

Per-rule breakdown

Below the summary, the CIS Diff tab lists mapped resources with source badges and can switch to a Missing-from-CIS view that lists missing benchmark rules. The status column is sortable.

Audit-pack export

Audit Pack export supports both PDF and Markdown. Both formats include manifest metadata and can include compliance, device-audit, history, rationale, and citations when those inputs are available. Open the baseline's Audit Pack and choose Download PDF or Download Markdown. Generating this report does not run a device Audit.

Today analysis provenance is not persisted per manifest, so the citations/provenance section is omitted in normal UI-generated audit packs. Both formats omit the CIS section gracefully when CIS data isn't available. See Audit-pack.

See also

• API Reference > Compliance
• User Guide > Audit-pack
• User Guide > Analysis provenance